Security
Your customers' conversations, kept safe
Businesses trust Custoz with their WhatsApp conversations. Here is how we protect them, and how to reach us if you find a problem.
Last updated 2026-10-26
Draft for legal review — not yet in force.
How we protect your data
Workspaces kept apart
Every record belongs to one workspace, and every query is limited to the workspace you're working in. The same customer number in two businesses is two separate contacts.
Access by role
Owners, admins and agents get different permissions, and you can create your own roles. Nobody can give a role more access than they have, or change their own.
Secrets sealed
WhatsApp tokens and integration keys are encrypted with AES-256-GCM before they are stored, and are never sent back to the browser.
Files behind short-lived links
Photos, documents and voice notes live in S3-compatible object storage. Each download checks your access first, then uses a signed link that expires after five minutes.
Signed webhooks
Messages from Meta and events from Shopify, WooCommerce, Razorpay and Stripe are checked against their signatures before anything is processed. Requests that fail are rejected.
Secure sign-in
Sessions are signed and kept in secure cookies, and passwords are stored only as hashes.
Privacy controls for your customers
When a customer asks to be forgotten, an admin can move their contact to the trash and then erase it permanently. To prevent mistakes, the admin has to retype the phone number before the erase runs.
Service providers
We run on a short list of providers: Meta's WhatsApp Cloud API for messages, Anthropic for AI replies, Railway for hosting and storage, and Resend for account emails. See the privacy policy for what each one receives.
What we don't claim yet
We don't hold third-party security certifications today. [Planned certifications and audit dates to be confirmed.] If your organisation needs a security questionnaire answered, contact us.
Report a vulnerability
If you think you've found a security issue in Custoz, email security@custoz.in with the steps to reproduce it. Please give us reasonable time to fix it before telling anyone else, and don't access or change other people's data while testing. We'll acknowledge your report and keep you updated as we work on it.