Security & Compliance
We consider the security of our customers' data a top priority. This page outlines the security measures and standards that Twasel implements to protect your data.
Infrastructure Security
- All connections are encrypted via HTTPS/TLS with current certificates
- Servers are protected by firewalls and 24/7 monitoring systems
- Backups are performed regularly and stored in encrypted form
- Server access is restricted to SSH keys and protected by two factor authentication
Data Encryption
- Credentials (API keys, access tokens) are encrypted using advanced global standards with unique keys per project
- Passwords are stored using one way encryption and cannot be retrieved by anyone, including the Twasel team
- Remember tokens and password reset links are generated using cryptographically secure algorithms with limited validity
Authentication & Session Management
- Two factor authentication is available for all users and mandatory for system administrators
- Sessions are protected against external exploitation and tied to device fingerprints
- Limits on failed logins with progressive temporary lockout to protect against brute force attacks
- Trusted devices are recorded and monitored; login from a new device requires additional verification
Data Isolation
Each project is fully isolated from other projects. Strict restrictions are enforced at every operation to prevent data leakage between subscribers. Employees can only access projects they are authorized for.
Inbound Message Security
No inbound message is accepted unless it comes from a verified source: a digital signature from Meta on the official connection, or the session paired with your device on Direct Linking. Anything else is rejected automatically and recorded in the security log.
Audit Logging
Every sensitive action within the platform is logged with details including: user, timestamp, IP address, and operation type. Logs are protected from tampering and available to project owners for review.
Content Filtering
The platform includes a content filtering system that prevents sending messages containing content that violates WhatsApp policies or local regulations. The system inspects content before sending to minimize violations.
Regulatory Compliance
Twasel is committed to complying with the following regulations and policies:
- Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia
- WhatsApp Business Platform policies by Meta
- The Saudi Cybercrime Law
- The Saudi Ecommerce Law
Incident Response
We maintain defined incident response procedures that include: detection and containment, assessment and investigation, notification (within 72 hours per PDPL), and remediation and documentation. We conduct periodic reviews to improve our security procedures.
Responsible Disclosure
If you discover a security vulnerability in our platform, we ask that you report it responsibly. We are committed to investigating all security reports and handling them confidentially.
Security Contact
To report a security issue or for any data security inquiries: legal@twasel.io