Skip to content
WAQR comes included with Emboxia, Zygore and AXEN.See how

Security and privacy

We store conversations of your business and your customers. We treat them accordingly.

A data leak between companies would be the worst possible failure for a product like WAQR. That is why isolation is not a feature: it is the first design rule, verified with automated tests on every change.

  • Isolation between companies

    Each organization lives in its own data space. Every database query must carry the company it belongs to, and the database itself rejects anything that does not. A resource from another company simply does not exist for you.

  • Encryption in transit and encrypted secrets

    All communication travels over HTTPS. Sensitive secrets (webhook keys, connection tokens) are stored encrypted with AES-256-GCM and versioned for rotation.

  • Credentials that do not leak

    API keys are shown once, stored as hashes and carry recognizable prefixes. They can be rotated and revoked instantly, and never appear in logs.

  • Explicit per-application permissions

    No system can grant itself access to a number. You give the authorization, per connection and with scoped permissions; revoking it cuts access immediately.

  • Files through time-limited links

    Images and documents are served from private storage through signed URLs that expire. The file type is detected rather than trusted from the sender.

  • Activity log

    Logins, connections, generated QR codes, granted or revoked permissions, created keys and plan changes are recorded. Owners see it in the dashboard and it cannot be edited.

Your data

What we store and for how long

We store what the product needs to work: messages, contacts and files from your connections, for your plan's retention period.

Retention according to your plan
Messages and files are kept for the number of days your plan specifies (shown on pricing and in the dashboard) and deleted afterwards.
Export and deletion
You can export your organization's data and request complete deletion when closing the account.
Staff access
The WAQR team only accesses an account's data to resolve an incident you report, and that access is logged.
Personal data protection
We operate under Peru's Personal Data Protection Law 29733. Regarding your customers' data, WAQR acts as data processor and your company as data controller.

Accounts and team

Controls for your account

Roles and scope
Owners, admins and agents. Agents only see the numbers you assign them.
Sessions
You can view and close your user's active sessions. Changing the password invalidates the other sessions.
Login protection
Lockout after failed attempts and email verification. Two-step authentication is mandatory for our own staff.
Linking with your systems
Emboxia, Zygore or AXEN accounts are linked only when you are authenticated on both sides at once; never by matching emails.

What we do not promise

  • We do not yet hold external certifications (ISO 27001, SOC 2). When we do, we will say so here.
  • We cannot prevent WhatsApp from blocking a number that breaks its rules. We apply per-connection sending limits and help with good practices, but responsible use is yours.
  • We do not publish availability figures until we have a real track record to back the number.

Found a vulnerability?

Write to us with the details and steps to reproduce it. We answer every report and keep you posted on the fix.

Report a security issue

Your WhatsApp should not be isolated from your systems.

Connect it once and use it wherever you need it.

Start with WAQR

Using Emboxia, Zygore or AXEN? Connect it from your account