Security, privacy and operational boundaries
Protect linked-device sessions, tokens, customer evidence, uploads and tenant/account access while understanding the module’s supported WhatsApp boundary.
Guides in this workflow
Select the exact setup, Inbox, verification, automation, portal, audit or troubleshooting action you need.
Understand the linked-device security model
The phone authorises a persistent WhatsApp Web device session that remains isolated per CRM account.
Understand the no-Business-API boundary
The module does not use WhatsApp Business API, Cloud API, Meta Graph API or public Meta webhooks.
Understand loopback connector protection
The private connector is intended for 127.0.0.1 and not for public Internet exposure.
Understand encrypted connector-token storage
Random connector secrets are encrypted using the CRM’s supported encryption service before database storage.
Rotate a connector token safely
Use the administrator-only internal rotation action only as part of managed repair; the connector configuration must be updated consistently.
Understand why tokens are not shown in normal settings
Zero-touch preparation removes the need for staff to copy secrets, ports or URLs.
Understand account session isolation
One account’s session, QR, event stream and runtime removal cannot intentionally remove another account’s session.
Understand CSRF protection
Administrator form and AJAX state-changing requests require the current CRM CSRF token.
Understand server-side permission checks
Menu hiding is not the only protection; each controller action rechecks native and per-account access.
Understand protected media paths
Download endpoints validate account/contact access and constrain the resolved file to the managed upload root.
Understand file-content validation
Uploads are checked by server MIME inspection and configured size rather than filename alone.
Understand client-portal ownership checks
The signed-in contact can retrieve only verified conversations and media linked to that contact.
Understand administrator customer-history scope
Staff history is filtered to accounts they can view.
Understand verification email privacy
The raw email reply is not copied into audit context; a one-way hash supports evidence without unnecessary disclosure.
Understand automated-message privacy
Audit/session event context stores identifiers and field lengths/results rather than duplicating raw customer replies.
Understand profile-photo privacy
Only a remote URL may be stored and it can expire; the module does not promise a permanent local image copy.
Understand retained compliance history
Soft deletion removes an account from operations but deliberately retains messages, verification and audit evidence.
Apply least-privilege account access
Grant only View, Reply, Convert or Manage required for each staff member and account.
Protect the connected phone and linked devices
Review WhatsApp Linked devices on the phone and unlink unfamiliar sessions immediately.
Run a security verification checklist
Test unauthorised Inbox access, media IDs, portal ownership, CSRF, account isolation, audit redaction and loopback-only connector binding.