Security

Operator: Codegrin Technologies · Product: WhatsApp AI Assistant · Last updated: September 8, 2026

Security Approach

Codegrin Technologies uses technical and organizational safeguards designed to reduce unauthorized access, disclosure, alteration, loss, and misuse of information handled by WhatsApp AI Assistant. No online system, connected device, storage method, or transmission method can be guaranteed to be completely secure.

The Service does not claim compliance with a particular security certification or audit standard unless that claim is expressly published by Codegrin Technologies.

Account and Authentication Security

Depending on the access method, the Service uses authenticated browser sessions or OAuth authorization. Current safeguards include:

password hashing where password login is enabled;
hashed storage of supported access, refresh, and authorization tokens rather than intentional plaintext storage in the application database;
expiring and revocable authentication records;
secure, HTTP-only authentication cookies in production;
OAuth scopes that limit the operations granted to an authorized client;
account-ownership checks for WhatsApp sessions and other user resources; and
separate authorization requirements for administrative functions.

Users must protect their passwords, devices, QR and pairing codes, one-time codes, API credentials, and access or refresh tokens. Do not share these credentials with support or another person.

WhatsApp Connections

Users connect a WhatsApp account through linked-device functionality using a QR code or supported pairing flow. The Service maintains credentials required to keep the linked session available until it is logged out, removed, invalidated, or otherwise disconnected.

The Service can process conversations and send messages through the connected account when requested through the workspace, API, or an authorized MCP client. If AI auto-reply is enabled for a conversation, a generated reply may be sent automatically without individual preview. Bulk campaigns also begin processing after user confirmation. Users are responsible for configuring these features carefully and monitoring the connected account.

Removing or logging out a WhatsApp session deletes its linked-device credentials from the Service, but does not by itself delete the complete user account or every message, campaign, payment, usage, or log record. See the Data Deletion Policy.

Application and Network Safeguards

The current application includes safeguards such as:

HTTPS requirements for production application and OAuth traffic;
security-related HTTP headers and restrictions on permitted frontend origins;
request validation and file or media input checks;
rate limits for general, authentication, OAuth, administrative, and write requests;
authenticated live-event connections;
redaction of specified credentials and payment signatures from application logs; and
request identifiers and security or error logs that assist investigation.

These measures reduce risk but do not eliminate it. Availability and security also depend on the user's device, network, WhatsApp account, hosting environment, and third-party providers.

Third-Party Services

Requested features may transmit limited information to WhatsApp, OpenAI, Razorpay, hosting providers, or a media host selected by the user. Each provider operates under its own security practices and policies. Review the Privacy Policy and Third-Party Services page for details.

User Security Responsibilities

Users should:

use a strong, unique password and secure the email account associated with the Service;
restrict access to devices containing an active WhatsApp or Service session;
review WhatsApp's linked-device list and remove devices that are no longer recognized or required;
authorize only trusted OAuth or MCP clients and grant only necessary permissions;
review recipients, message content, templates, and campaign settings before sending;
disable AI auto-reply when human review is required;
avoid submitting secrets or unnecessary sensitive personal information; and
promptly report suspected unauthorized access.

If compromise is suspected, unlink the affected device through WhatsApp, sign out of the Service where possible, revoke relevant client access, change affected credentials, and contact support.

Reporting a Vulnerability

Report suspected vulnerabilities privately to support@whatsappaiassistant.com with the subject Security Report. Include a clear description, affected URL or feature, reproducible steps, and the potential impact. Do not include passwords, tokens, private keys, complete payment-card details, or unnecessary personal information.

When testing or reporting a security issue, do not:

access, modify, copy, or delete another user's information;
disrupt availability, send unsolicited messages, or perform denial-of-service testing;
use social engineering, phishing, physical intrusion, or automated high-volume scanning;
exploit a vulnerability beyond what is reasonably necessary to demonstrate it; or
publicly disclose an unresolved issue before Codegrin Technologies has had a reasonable opportunity to investigate and address it.

Submitting a report does not create a promise of payment, reward, safe-harbor protection, or a guaranteed response or remediation time unless separately agreed in writing.

Contact

Security and suspected account-access concerns may be sent to support@whatsappaiassistant.com.