SECURITY
Security, explained honestly.
How ConvoHut protects your data, what Meta and AWS are responsible for, what you control, and what we don’t claim.
Illustrative example. Names and details are made up.
OVERVIEW
The short version.
Your accounts stay yours
Your WhatsApp Business Account, Google account and Shopify store stay in your name. You can remove ConvoHut’s access at any time.
Official Meta platform
Messages go through Meta’s WhatsApp Business Platform Cloud API, connected through Meta’s own signup. No unofficial workarounds.
Hosted on AWS
ConvoHut runs on Amazon Web Services infrastructure.
Only what we need
We read the sheets and store events you connect, and keep the contact details and messages needed to run your journeys and inbox.
DATA FLOW
How your data moves.
| Where | What |
|---|---|
| In ConvoHut | Your account and team details, connection settings, contacts you import or sync (name, phone, email, consent status, tags), automation and campaign settings, and message history for the shared inbox. |
| At Meta | WhatsApp messages are sent and received through Meta’s Cloud API. Meta processes them on your behalf under your agreement with Meta and, according to Meta, keeps message content for up to 30 days. Meta says Cloud API “will not automatically use WhatsApp messages to inform the ads that a person sees”. |
| In your Google account | Your spreadsheets stay in your Google Drive. ConvoHut reads the sheets you connect. |
CONTROLS
What we do.
| Control | How it works |
|---|---|
| Encryption in transit | The ConvoHut app and our connections to Meta, Google, Shopify and Zapier use HTTPS with TLS. |
| Encryption at rest | Data stored in AWS is encrypted at rest. |
| Access to WhatsApp | Meta’s Embedded Signup gives ConvoHut a token scoped to your WhatsApp Business Account. You can remove our access in Meta Business Settings at any time. |
| Access to Google Sheets | You connect Google through Google’s own sign-in. You can remove access at myaccount.google.com, under third-party connections. |
| Access to Shopify | ConvoHut asks only for the store permissions it needs. Uninstall the app to remove access. |
| Your number’s PIN | ConvoHut sets the two-step verification PIN when it registers your number, and can share it with you if you move providers. |
| Our team’s access | Only people who need access to run and support ConvoHut have it. Infrastructure accounts use multi-factor authentication. |
| Separation | Each workspace’s data is kept logically separate from other customers’ data. |
| Backups | We back up data so we can recover from failures. |
| Incidents | If a security incident affects your data, we’ll send an initial notice without undue delay, and within 72 hours of becoming aware, then updates as we learn more, as set out in our Data Processing Addendum. |
| Deletion | For 30 days after your account ends you can ask us to export your data. We then delete Customer Data from our live systems within 30 days, and backups roll off on their normal cycle, unless the law requires us to keep it. |
SHARED RESPONSIBILITY
Who’s responsible for what.
| Party | Responsible for |
|---|---|
| ConvoHut | The application, its access controls and connections, how we store and delete your data, and our team’s access. |
| You | Who you message and with what consent, your team’s log-ins, removing people who leave, what you put in sheets, and the security of your Google, Meta and Shopify accounts. |
| Meta | The WhatsApp network and Cloud API, message delivery, and message storage at Meta. |
| AWS | The physical data centres, hardware and core cloud infrastructure ConvoHut runs on. |
HONESTY
What we don’t claim.
YOUR PART
Keep your account secure.
- Use a strong, unique password for ConvoHut and turn on two-factor authentication for your Facebook and Google accounts.
- Remove team members who no longer need access.
- Only put the data your journeys need in connected sheets. No clinical details (symptoms, diagnoses, treatment notes), card numbers or ID numbers. For clinics, keep appointment data to name, phone, time and practitioner.
- Review who has admin access to your Meta business portfolio.
- Tell us straight away if you notice anything unusual.
DISCLOSURE
Report a vulnerability.
If you think you’ve found a security issue in ConvoHut, email abhishek@convohut.com with the details. Please don’t access other people’s data, disrupt the service or publish the issue before we’ve fixed it. We’ll acknowledge your report and keep you updated.
FAQ
Security questions.
Where is my data stored?
ConvoHut is hosted on Amazon Web Services. WhatsApp message content is also processed by Meta in Meta’s data centres. Our Sub-processors page lists every provider.
Can ConvoHut read my WhatsApp messages?
ConvoHut stores the messages sent and received through your connected number so your team can see them in the inbox. Our staff access them only to support you or when the law requires.
Do you sell or share my contacts?
No. We never sell Customer Data, use it to profile WhatsApp users, or use it to train AI models. Meta’s terms also prohibit selling or profiling.
Is WhatsApp end-to-end encrypted through ConvoHut?
Messages are encrypted between WhatsApp and Meta’s Cloud API. Because Meta’s Cloud API handles messages on your behalf, it isn’t end-to-end encrypted to your business in the same way as the WhatsApp app.
Can I get a Data Processing Addendum?
Yes. Our DPA is part of our Terms and includes GDPR Article 28 terms and Standard Contractual Clauses.
WHY TEAMS TRUST CONVOHUT
Built on Meta’s official platform. Run from Australia.
LIVE NOW · 7-DAY FREE TRIAL
More sales from every conversation.
WhatsApp marketing, sales and support from your own number. 7-day free trial, free onboarding and Meta verification help.
- Meta Tech Provider
- Hosted on AWS
- Australian company
- Your number stays yours
