Trust and security
Connect Wasl is built to align with the Saudi Personal Data Protection Law (PDPL). We act as a processor for the customer data our clients handle through the service, and we sign a PDPL-aligned Data Processing Agreement. This page explains the technical and organizational measures we take to protect your data.
Where is Connect Wasl data stored?
Our primary database and file storage run on Supabase in Frankfurt, Germany (AWS eu-central-1, EU). Some sub-processors are in the United States, so some data (for example, message content sent for AI replies or queued for delivery) is processed there. Our full sub-processor list and regions are published on our sub-processors page.
Is my WhatsApp data stored in Saudi Arabia?
No. Our primary database and file storage are in the European Union (Frankfurt), and WhatsApp itself runs on Meta's global infrastructure, so WhatsApp message data is not stored inside Saudi Arabia. A cross-border transfer like this may be permitted under the Saudi PDPL when the applicable purpose and conditions are met, including an adequate level of protection or a valid exemption with the required safeguards, any required transfer risk assessment, and limiting the transfer to the minimum data necessary. We maintain an internal international-transfer risk assessment covering our infrastructure and sub-processors, apply Saudi Standard Contractual Clauses where relevant, and minimize the data that reaches each provider.
How is data encrypted?
Data is encrypted in transit with TLS and encrypted at rest by our infrastructure providers. WhatsApp media is stored in a private storage bucket that is not publicly accessible.
How do you keep one business's data separate from another's?
Every tenant's data is isolated at the database level using row-level security, so one account cannot read another account's conversations or contacts. Access is least-privilege, and account owners can enable two-factor authentication (TOTP).
Can Connect Wasl staff read my WhatsApp conversations?
Not in the normal course of running the service. Your own team's access is scoped to your account by row-level security and least-privilege roles. For support, an authorized administrator can open a time-limited (30-minute), audited in-app session to your account: it is shown to you with an on-screen banner while active, limited to a read-only view of your inbox, and it blocks account-sensitive actions (billing, staff changes, account deletion, disconnecting your number). Broader infrastructure access is restricted to authorized personnel under least-privilege and confidentiality controls.
How do you protect the platform itself?
Incoming WhatsApp webhooks are verified with a signature so we only accept authentic events. Public and sensitive endpoints are rate limited, sign-up is protected by a bot check (Cloudflare Turnstile), and traffic is fronted by a CDN and web application firewall (Cloudflare).
How long do you keep data, and how is it deleted?
When an account is closed we soft-delete it and retain it for 30 days (in case of accidental deletion or a dispute), then purge it, unless a longer period is legally required. Customers can also request deletion of specific data.
How are backups and recovery handled?
The database is protected by continuous point-in-time recovery with a 7-day retention window, so we can restore it to any moment (down to the second) within the last 7 days if data is lost or corrupted. This recovery data is encrypted at rest by our infrastructure provider. Because it is kept for about 7 days, data you delete may still exist in the recovery window until it ages out, after which it is gone.
What happens if there is a security incident?
We detect and triage incidents, contain them, and keep an incident register. If a personal data breach affects customer data, we notify the affected controller without undue delay and within 24 hours of becoming aware, so the controller can meet its own regulatory notification duties.
Related
Security questions: info@connectwasl.com