Security

Last updated: 20 October 2026

You trust IGNIPOST Chat with a live link to your WhatsApp number and with your customers' messages. This page explains how we protect that link and that data, what you can do to help, and how to report a security problem to us.

Encryption

In transit

All traffic between your browser and IGNIPOST Chat uses TLS (HTTPS). Connections from IGNIPOST Chat to WhatsApp and to our service providers are also encrypted.

At rest

Data stored on our servers and in file storage is encrypted at rest.

WhatsApp sessions and end-to-end encryption

WhatsApp encrypts messages end to end between devices. IGNIPOST Chat is one of your number's linked devices, so messages are decrypted on our servers to send, receive and show them, just as they are on your phone. The session data that keeps your number linked stays on our servers, is used only to run the features you turn on, and is deleted when you delete the device.

Passwords

We never store your password in readable form. We store only a one-way hash, so no one on our team can see it. If you forget it, you reset it; we cannot send it to you.

API keys and webhooks

API keys give access to your account through the developer API, so treat them like passwords. Store them only in your own systems, never in public code, and tell us at once if you think one has leaked. Webhooks send data to the URLs you set: use HTTPS addresses that you control.

Role-based access in your workspace

Team workspaces use roles, so each person sees and does only what their role allows. Workspace owners choose the roles and can remove a member at any time.

Our own access controls

• Only the staff who need it to run and support the service, at Sinergia Ventures LTD and at IGNITECH SARL AU, our technology service provider, can access production systems.
• Administrative access is protected and limited to named staff.
• We look at customer content, such as contacts and chats, only when it is needed to provide support you asked for, to keep the service secure, or when the law requires it.

Infrastructure

Our servers are in the European Union (Germany) and sit behind Cloudflare, which filters traffic before it reaches them.

Logging and monitoring

We keep security logs, including IP address and user agent, for up to 90 days. They help us detect unusual activity and investigate problems. The activity log in your workspace shows what campaigns and automations sent, so you can check them too.

Backups

We back up our data regularly so we can recover from failures. Backups roll off within 35 days, so data you delete also leaves our backups within that time.

Incidents

If a security incident affects your personal data, we will tell you without undue delay. For customer data we process for you, we will notify you within 72 hours of becoming aware, as set out in our Data Processing Addendum.

Certifications

We do not currently hold security certifications such as ISO 27001 or SOC 2. We will update this page if that changes.

What you can do

• Use a strong password that you do not use on any other site.
• Give each team member the lowest role they need, and remove team members as soon as they leave.
• Check the Linked devices list in WhatsApp on your phone from time to time, and log out any session you do not recognize.
• Turn on two-step verification in WhatsApp for every number you connect.
• Delete devices you no longer use in IGNIPOST Chat.
• Never share a WhatsApp verification code or your IGNIPOST Chat password. We will never ask for either.

Report a vulnerability

If you find a security weakness in IGNIPOST Chat, please email [email protected]. Include:

• a description of the issue and where it is;
• the steps to reproduce it;
• what an attacker could do with it.

While you research, please:

• access only the data you need to show the issue, and never other users' data;
• do not send messages to real contacts, and do not run denial-of-service tests, spam or social engineering;
• give us reasonable time to fix the issue before you share it publicly.

We will acknowledge your report, keep you informed while we work on it, and credit you if you wish. If you act in good faith and follow these rules, we will not take legal action against you for your research.

Contact

Security reports: [email protected]. Privacy questions: [email protected]. Read more in our Privacy Policy.