Account security
- Passwords are stored only as bcrypt hashes. We never store plain passwords.
- Sign-in sessions use signed tokens in HttpOnly, Secure cookies, and login endpoints are rate-limited.
- Password resets use one-time links that expire in one hour; only a hash of each reset token is stored.
- Team roles (owner, admin, agent) limit what each member can see and do.
Sign-in protections
Two-factor authentication. Any user can turn on 2FA in Settings, Security. Sign-in then needs the password plus a 6-digit code from an authenticator app (Google Authenticator, Microsoft Authenticator, Authy). Codes follow the standard TOTP protocol; the shared secret never leaves your account record, and turning 2FA off requires a current code or the account password.
Email verification. New accounts confirm their email address from a link that lives 24 hours and works once. Verification keeps password recovery honest and proves the address belongs to the account holder.
Password policy. Passwords need at least 10 characters with an uppercase letter, a lowercase letter and a number, and are stored only as bcrypt hashes. Reset links live 1 hour, work once, and are stored as SHA-256 hashes, never in plain text.
Team invitations. Owners invite members by email. Each invitation is a personal, single-use link that lives 7 days; the invitee sets their own password, so no credential is ever shared or known by the inviter. Invitations can be revoked while pending.
Abuse controls. Registration and invitations reject disposable (temporary) email services, sign-in and API endpoints are rate-limited, and every sensitive action is written to the workspace activity log with the acting user.
WhatsApp connection security
- Every webhook event from Meta is verified with an HMAC signature before we act on it; unsigned or forged events are rejected.
- WhatsApp access tokens are kept on the server only, never exposed to browsers or other tenants.
- Connecting happens through Meta's own Embedded Signup: we never ask for your Facebook or WhatsApp password.
Data isolation
Every business's data is scoped to its own workspace at the database level. One business cannot list, search or open another business's conversations, contacts or templates — every request is checked against the signed-in user's memberships.
Transport and storage
- All traffic uses HTTPS with modern TLS; certificates renew automatically.
- Servers run with key-only administrative access, an active firewall and intrusion-prevention (fail2ban).
- Backups are kept by our hosting provider; deletion requests age out of backups as described on the Data Deletion page.
What we do not claim
We do not claim certifications we do not hold. Where a control is operated by our hosting provider or by Meta, we say so rather than dressing it up as our own.
Report a vulnerability
If you believe you have found a security issue, email admin@digilistan.com with the details. Please give us a reasonable time to fix it before publishing, and do not access other customers' data while testing. We thank researchers who report responsibly.