ENBMGet started

Legal

Security

Last updated:

This page explains how we protect MacroWA accounts and the data in them, what you can do on your side, and how to report a security issue to us.

1. Protecting your account

  • Two-factor authentication is available for every account. We recommend turning it on.
  • CAPTCHA on sign-in stops automated sign-in attempts.
  • Team roles and permissions let you give each team member only the access they need. Owners keep full control.
  • An activity log shows who did what in your account, and when.

2. Protecting your data

  • Encrypted connections. The website, the dashboard and the API use HTTPS.
  • Encrypted secrets. Secrets such as API keys and connected tokens are stored encrypted.
  • Daily backups. We back up data every day.

3. API keys and webhooks

  • API keys are shown once, when you create them. You can limit a key to chosen WhatsApp numbers, replace it, or revoke it at any time.
  • Outgoing webhooks are signed with HMAC-SHA256, so your system can check that a webhook really came from MacroWA. Failed deliveries are retried automatically, and a delivery log shows what was sent.

4. What you can do

  • Turn on two-factor authentication, for you and your team.
  • Give team members only the roles they need, and remove people who leave.
  • Keep API keys secret. Do not put them in public code or share them in chat.
  • Replace or revoke any key you think may be exposed, and any key you no longer use.
  • Check the signature on every webhook you receive.
  • Review the activity log from time to time.

5. Reporting a vulnerability

If you find a security issue in MacroWA, please tell us. Email [email protected] with the subject “Security report”. Include:

  • what you found and where;
  • the steps to reproduce it;
  • any proof of concept, screenshots or logs that help.

Please give us reasonable time to fix the issue before you disclose it to anyone else.

6. Testing rules

When looking for issues, please:

  • do not access, change or delete other people’s data;
  • do not run denial-of-service tests;
  • do not send spam or use social engineering on our staff or customers;
  • test only against accounts you own.

7. What we do

We will acknowledge your report and keep you informed while we look into it and fix it. We do not run a bug bounty, and we do not promise payment for reports.