At Seen, security is foundational to everything we build. This document outlines the technical and organizational measures we implement to protect customer data and messaging interactions.
1. Encryption Everywhere
- All data in transit between your browser, our servers, and Meta WhatsApp APIs is encrypted using modern TLS 1.3.
- Data at rest in databases, message stores, and backups is encrypted using AES-256.
- API keys, webhook secrets, and external integration tokens are held in a dedicated secrets manager with envelope encryption.
2. Access Controls & Governance
- Role-based access control (RBAC) with granular permissions across workspaces, channels, inboxes, and analytics.
- Mandatory Multi-Factor Authentication (MFA) for all internal employees and recommended for workspace admins.
- Least-privilege access: Seen personnel cannot access customer message logs without an active support ticket and customer authorization.
3. Infrastructure & Resilience
- Hosted in audited tier-1 cloud facilities featuring SOC 2 Type II and ISO 27001 certifications.
- Web Application Firewalls (WAF), rate limiting, and DDoS mitigation protect public endpoints.
- Regular external penetration tests and automated continuous vulnerability scanning.
4. Compliance & Meta Partnership
- Official Meta Business Solution Provider with direct WhatsApp Cloud API compliance.
- GDPR-aligned data processing with DPA (Data Processing Agreements) available.
- Payment processing handled exclusively by certified PCI-DSS Level 1 payment providers.
5. Business Continuity
- Daily automated backups with point-in-time recovery capabilities.
- Redundant multi-zone high-availability architecture with a 99.9% uptime SLA on enterprise plans.
6. Responsible Disclosure
Security researchers are encouraged to report any vulnerabilities to [email protected].