Security and privacy

The controls that exist today, the gaps that remain, and the safe way to use the beta.

Evidence-backed controlsNot a compliance claim

Account access

WALAO uses passwordless email codes. A code expires after 15 minutes and is stored only as a hash. Successful verification rotates a random session token that expires after 30 days.

The browser cookie is HttpOnly and SameSite Lax. It is marked Secure outside localhost. Logging out revokes the token in the database.

Login and verification attempts are limited by normalised email address and source address. Responses avoid revealing whether an account exists.

Account isolation

Authenticated API reads and writes add the account ID to their database queries. Requests for another account's object return as missing rather than exposing its existence.

There is no database row-level security layer in the current schema. Isolation depends on application query boundaries and their tests.

Webhook and processing controls

Gateway webhooks require an HMAC-SHA256 signature.
Malformed, stale, oversized, unknown-session, and replayed events are rejected or ignored.
Messages sent by WALAO itself are dropped to prevent loops.
Paused, disconnected, disabled, halted, unpaid, or over-cap paths stop processing.
Summary, answer, and pick outputs are validated before storage or display.

Encryption and secrets

Normalised message bodies use AES-256-GCM with a separate data key for each account. That key is wrapped with an application master key supplied through configuration.

Authentication tokens, login codes, and operator session tokens are stored as hashes. The application expects gateway, email, AI, database, webhook, operator, and encryption credentials through environment variables.

Encryption does not cover every content field

Raw ingestion payloads, summaries, reminders, memories, and several metadata fields are readable in the database. WALAO is not end-to-end encrypted or zero-knowledge.

Operator access

The operator console exposes account email, status, connection identifiers, counts, job state, and token usage. It intentionally omits message bodies and group names.

Summary review is the content exception. It is designed to require your quality-review opt-in. Reviews already recorded remain part of the quality trail after opt-out.

Metadata can still be sensitive

Account identity, usage, connection status, and activity times can reveal business patterns even without message bodies.

Browser protections

Responses set a restrictive Content Security Policy, HSTS, no-sniff, frame denial, no-referrer, and permissions restrictions for camera, microphone, and location. Static files are served through a traversal guard.

Current limits and safe use

The WhatsApp gateway is unofficial and can put the paired account at risk.
Raw event payloads can outlive the selected message retention window.
Direct chats can be misclassified during message-driven discovery.
The product Disconnect control does not reliably terminate the upstream session.
Backup, production transport, monitoring, incident response, and residency claims are not proven by this repository.

Use a spare number, avoid confidential or regulated groups, verify every enabled entry, and revoke the linked device directly in WhatsApp when leaving.