Security and service model

Account and resource access#

Email verification is required before workspace access. Browser sessions and public API tokens are separate credentials. Each resource is checked against its owner; a key’s scopes do not permit cross-account access.

Enable an authenticator in Account settings, keep its backup safe, and revoke API keys you no longer use. Email and password changes require confirmation; completed changes invalidate old browser sessions.

Credential handling#

Passwords and API tokens are stored as hashes. Integration secrets and stored message/webhook payloads use authenticated encryption. Customers do not receive the upstream gateway’s administrator key.

Treat a pairing QR code as an account authorization credential. Use HTTPS and server-side token storage, restrict access to logs and dashboards, and verify inbound webhook signatures.

Data retention#

The application’s default maintenance policy clears message and webhook payloads after seven days. Usage, delivery metadata, security records, and financial records may be retained longer for operation and legal obligations.

Your integration should retain its own required business records. A webhook destination is not a substitute for a backup or an application event log. See Privacy for the service’s data-processing details.

Connection limitations#

TurbineWhats.app uses independent WhatsApp Web connectivity. It is not Meta’s official WhatsApp Business Platform and is not affiliated with or endorsed by WhatsApp or Meta.

WhatsApp protocol changes, device authorization, account restrictions, or bans can interrupt service. Neither a trial nor a paid plan removes those risks. No published uptime SLA or guaranteed delivery time is offered. Keep a separate channel for authentication, emergency alerts, or other critical messages.

Send only expected messages to consenting recipients. Spam, scraped lists, impersonation, fraud, unsolicited campaigns, and attempts to bypass sending restrictions are prohibited.