Keywords and buttons
STOP, STOP ALL and START (and your own keywords), the “Stop promotions” button, and WhatsApp's own marketing opt-out are all recognised.
Security & compliance
Security and consent, by design.
Your WhatsApp number is only as healthy as the consent behind it, and your customers' data is only as safe as the weakest login. Here is what i-Connect does about both.
Consent ledger
Every opt-in and opt-out, on the record
Consent is stored as a history of events, not a single yes/no that anyone can overwrite.
- Each change records its source and evidence: the form and the exact consent text and version, the WhatsApp Flow, the message, the import declaration, the IP address and time for web forms.
- Marketing and service (utility) consent are kept separately, so someone who asked for reminders doesn't get promotions.
- Only one part of the system can change consent, and automated architecture tests enforce that.
Opt-out handling
“Stop” means stop, everywhere, at once
Immediate, on every source
An opt-out applies at once to broadcasts, sequences and forms, ends the person's sequences, and cancels messages already queued for them.
Can't be undone by accident
A list import never re-subscribes an opted-out number. A web form can't either: the person must confirm on WhatsApp from that number.
Erasure that remembers “no”
Erasing a contact removes their personal data. Only a one-way hash of the number is kept, so they're never messaged again by mistake.
Protecting your account and data
Controls built into the product
Encryption
- WhatsApp access tokens and other secrets are encrypted with AES-256-GCM envelope encryption. They are never shown again, returned by the API or written to logs.
- Contact imports and exports are encrypted at rest and deleted automatically after a short time.
- Passwords are hashed with Argon2id and checked against known breached passwords. API keys and session tokens are stored only as hashes.
- All traffic uses TLS, with HSTS.
Sign-in and access
- Six roles (Owner, Admin, Manager, Agent, Analyst, Billing). The server checks every request against the role, not just the screen.
- Two-factor sign-in with an authenticator app and one-time recovery codes. An organisation can require it for everyone.
- Sign-in attempts are rate-limited and accounts lock after repeated failures.
- When someone is removed or their role changes, their access changes within seconds.
Number masking
- Agents can work with phone numbers masked. Revealing a number is a separate permission, and each reveal is recorded.
- Masking applies in the inbox, reports and exports, and is enforced by the server.
Audit log
- Sign-ins, role and team changes, exports, number reveals, broadcast launches and approvals are recorded with who, what and when.
- If our support staff ever need to look inside your organisation, they must give a reason; access is time-limited, read-only by default, and appears in your audit log.
Isolation between organisations
- Every request is scoped to one organisation. Automated tests try every endpoint with another organisation's IDs on each build and must be refused.
- Messages from Meta are accepted only with a valid signature.
Exports and files
- Every export is recorded in the audit log, and spreadsheets are protected against formula injection.
- Uploaded files are checked by their content, not their name, and size-limited.
DPDP Act, 2023
You decide about your contacts' data. We process it for you.
For the contacts you message, your business is the Data Fiduciary and Layap Infotech is your Data Processor. i-Connect gives you the tools to meet your obligations.
- Notice and consent: versioned consent text on forms and Flows, with a purpose for each.
- Withdrawal as easy as consent: STOP and opt-out buttons, applied immediately.
- Access and correction: view and edit a contact, and export their data in a machine-readable file.
- Erasure: erase a contact and their messages and form answers; only a one-way hash stays so they are not messaged again.
- Breach notification: if we become aware of a breach affecting your data, we tell you without delay so you can meet your own duties.
Read more in our Privacy Policy and Data Deletion Instructions.
Built for Meta's messaging policies
Opt-in before business-initiated marketing, opt-outs honoured immediately, template categories explained before you submit, and sending paused automatically when a number's quality drops or a template is paused. Our Acceptable Use & Messaging Policy sets the rules every business on i-Connect follows.
Report a security issue
If you believe you've found a vulnerability, email support@i-connect.world with “Security” in the subject. Please don't access other people's data or disrupt the service while testing. We'll reply and keep you informed.
We don't claim certifications we don't hold. When we have them, they'll be listed here.
Questions from your security or compliance team?
We're happy to walk them through how i-Connect handles data, consent and access.
Or write to sales@i-connect.world