Security

Built for many businesses, each in its own workspace

CloudVisan is multi-tenant software. Each business connects its own Meta assets, sees only its own data, and keeps control of its own billing.

Ownership

Tenant ownership

Your Meta assets stay yours
You connect your own Meta Business Portfolio, WhatsApp Business Account, phone number and catalog. CloudVisan is software you use with them, not a reseller of them.
Two separate bills
Meta bills WhatsApp messaging to your Meta account. Your CloudVisan subscription is billed separately, and so is any voice-AI or payment provider you connect.
Workspaces are isolated
Chats, contacts, templates, connections and recordings are kept separate for your workspace on our servers, not only hidden on screen.
Secrets are not shown back
Keys and passwords you give CloudVisan can be replaced but never read back on screen, and connection secrets are stored scrambled.
Sessions in secure cookies
Sign-in sessions live in an http-only cookie, and changing the password ends every existing session.
No approval claims
CloudVisan does not claim Meta partner status or approval it has not been granted, and features that need Meta to enable them for your number say so.

Practices

Server-side scoping
Workspace data is filtered by the signed-in owner on the server, so another workspace's chats, contacts or webhooks are not reachable by changing an id.
Write-only secrets
Meta tokens, SMTP passwords and gateway keys are never sent back to the browser. Blank fields keep the stored value.
Hashed webhook secrets
Webhook secrets are stored as SHA-256 hashes and compared in constant time; webhooks are rate-limited and logged.
Session control
Sessions sit in http-only cookies. A password change or reset ends every existing session, and reset links work once.
Sanitised public content
Pages authored in the admin are cleaned of scripts and event handlers before any visitor sees them.

Platform

Available
Your data stays in your workspace
Every workspace's chats, contacts, templates and connections are kept separate on our servers, not only hidden on screen.
Available
Plan limits and usage
Contact and number limits from your plan, enforced by the server and shown in the workspace.
On the roadmap
Workspace audit log
Who changed what in the workspace, and when.

Found a security issue? Tell us through the contact form and please do not test against other customers' workspaces.

Access is by invitation while we onboard businesses one at a time. Tell us about yours and we will set up a workspace.