All data stored on MetaBSP infrastructure is encrypted using AES-256, the industry standard for data encryption at rest.

• Database encryption: AES-256 at the disk level (dm-crypt / LUKS)

• Object storage (S3-compatible): SSE-AES256 server-side encryption

• Database field-level encryption for sensitive fields (tokens, secrets)

• Encrypted backups using the same AES-256 standard

• Keys managed through a dedicated Key Management Service (KMS)

• Key rotation performed every 90 days

All communications between clients and MetaBSP servers, and between our services, use TLS encryption.

• TLS 1.3 enforced for all public API endpoints

• TLS 1.2 minimum (TLS 1.0 and 1.1 are disabled)

• HSTS (HTTP Strict Transport Security) enabled with 1-year max-age

• Certificate pinning for our mobile clients

• Internal service-to-service communication uses mutual TLS (mTLS)

• Webhook deliveries made over HTTPS only; HTTP endpoints rejected

WhatsApp Business API tokens and webhook secrets are among the most sensitive data we store. We apply additional protection beyond disk encryption.

• API access tokens encrypted with a separate application-layer AES-256 key

• Webhook verification secrets stored in encrypted form, never in plaintext

• API keys displayed only once at creation; thereafter stored as bcrypt hashes

• Environment secrets managed through a secrets management vault (HashiCorp Vault)

• No secrets stored in source code or environment variables in plain text

• Regular automated secret scanning of our repositories

All webhooks delivered by MetaBSP include cryptographic signatures so you can verify they originate from our servers.

• HMAC-SHA256 signature included in the X-MetaBSP-Signature-256 header

• Signatures computed using your per-endpoint webhook secret

• Timestamp included to prevent replay attacks (5-minute tolerance window)

• Detailed signature verification guide provided in our developer docs

• Webhook secrets rotatable at any time from your dashboard

We maintain comprehensive audit logs of all significant actions within the platform for security investigation and compliance.

• All API calls logged with timestamp, IP address, user agent, and response code

• Authentication events (login, logout, failed attempts, MFA) logged

• Account changes (settings, team members, permissions) logged

• API key creation, rotation, and deletion logged

• Webhook configuration changes logged

• Audit logs retained for 2 years

• Audit logs exported in SIEM-compatible JSON format

User sessions are managed securely to prevent unauthorized access.

• Session tokens generated using cryptographically secure random number generators

• Sessions expire after 8 hours of inactivity

• Dashboard sessions bound to the originating IP address (configurable)

• Multi-factor authentication (MFA) available and encouraged for all accounts

• MFA required for accounts with Admin or Owner roles

• Active sessions viewable and revocable from Account Settings

• All sessions invalidated on password change

We log IP addresses for security purposes and provide tools for IP-based access restrictions.

• IP address logged for all authentication events and API calls

• IP allowlist available to restrict dashboard access to specified IP ranges

• Brute-force protection: accounts temporarily locked after 10 failed login attempts

• Rate limiting applied to all API endpoints (configurable per plan)

• Anomalous login detection with email alerts for new devices/locations

• IP logs retained for 1 year

MetaBSP is actively pursuing SOC 2 Type II certification, demonstrating our commitment to enterprise-grade security controls.

• SOC 2 Type I audit: Completed Q1 2025

• SOC 2 Type II audit: In progress (expected completion Q4 2025)

• Covers Trust Service Criteria: Security, Availability, and Confidentiality

• Annual penetration testing by a third-party security firm

• Quarterly vulnerability assessments

• Formal incident response plan with defined SLAs

• Business continuity and disaster recovery plan maintained