Security at WAExtension
What security standards does WAExtension follow?
WAExtension uses client-side architecture, TLS 1.2+ encryption in transit, AES-256 encryption at rest, PCI-DSS Level 1 payment processing, least-privilege access controls, and vulnerability disclosure programs.
WAExtension is an independent software product and is not affiliated with, operated by, sponsored by, or endorsed by WhatsApp or Meta Platforms, Inc., unless otherwise stated. WhatsApp is a trademark of Meta Platforms, Inc. All third-party names and logos referenced on this site belong to their respective owners and are used for identification purposes only.
Architecture choices
The extension runs client-side against the WhatsApp Web DOM you already trust. Structured CRM records you create sync to encrypted workspaces on paid plans; Free-tier data never leaves your browser. There is no mechanism for silent transcript harvesting — core features simply don't need message bodies.
Encryption
TLS 1.2+ in transit; AES-256 at rest for workspace storage; secrets rotated on schedule. Payment card data is handled entirely by our PCI-DSS Level 1 processor — card numbers never touch our servers.
Access control & monitoring
Least-privilege production access, hardware-key MFA for staff, immutable audit logs, anomaly alerting, and quarterly access reviews. Roadmap: customer-visible audit logs and SSO on Business plans.
Vulnerability disclosure
We welcome research. Report issues to security@waextension.com; good-faith testing won't be prosecuted, and confirmed findings get credited on request.
Incident response
Documented runbook with containment, forensics and notification duties; affected customers receive notice without undue delay where personal data is involved, consistent with the privacy policy.
Security FAQ
Primary hosting is in EU regions; paid-workspace traffic routes through our CDN. Local browser storage always remains on your device.
No. Message content is not synced by core features; encrypted workspace records require customer keys to interpret, and access is logged and least-privilege.
Email security@waextension.com. Expect acknowledgement within 1 business day.
Structure without exposure
Organise your pipeline knowing exactly where your data lives.