ConverZAP keeps each company’s WhatsApp conversations, contacts and integrations separated by account, with encrypted credentials (AES-256-GCM), two-step login, access roles and hourly encrypted off-site backups. WhatsApp is connected through Meta’s official API, and conversations are not used to train AI models. The data protection officer (Brazil’s LGPD) is Conrado Vita, at contato@converzap.com.
Each company’s data is kept apart
- Each company has its own account (workspace). In the database, every table with customer data carries the account ID and row-level security rules that stop one account from reading another’s data.
- Permissions are checked on every query: if a member is removed or changes role, access changes immediately.
- The browser never talks to the database directly. Everything goes through the application server, and the database key stays on the server.
- Files are kept in private storage and are only served to signed-in users with access to that account.
Access and accounts
- Sign-in uses a password plus a 6-digit code sent by email (two-step verification). Passwords are stored only as an irreversible hash.
- Sessions expire after 2 hours of inactivity.
- Roles per person: owner, admin, member and viewer (read-only), and each member’s access can be limited to some modules.
- Important account actions are kept in an audit log.
Credentials and integrations
- Integration tokens and keys (WhatsApp, Google, Meta, WordPress, AI keys and others) are stored encrypted with AES-256-GCM. The screen only shows the last characters.
- Addresses entered by customers, such as the AI agent’s custom tools, go through a protection that blocks internal and private addresses.
- Public API keys and AI assistant connections (MCP) are per user, with chosen permissions, optional expiry and IP restriction, and can be revoked at any time.
WhatsApp and artificial intelligence
- ConverZAP is a Tech Provider verified by Meta and connects numbers through the official WhatsApp Business Platform (Cloud API). The WhatsApp account and message billing stay in the company’s own name, directly with Meta.
- Conversation content goes to the AI provider (Google, OpenAI or Anthropic) only to generate the reply. These providers’ paid APIs do not use this data to train models. Companies can use their own AI key.
- Opt-out requests (SAIR, PARAR, STOP or the stop-promotions button) are honored automatically in broadcasts.
Infrastructure and backups
- All connections use HTTPS.
- Data is stored on cloud servers, in Brazil and/or other countries with an adequate level of protection, as described in the Privacy Policy.
- The database has an encrypted off-site backup every hour and a full backup every day, and an automatic restore test runs every month.
Your rights and the data protection officer
- Data protection officer: Conrado Vita, founder of ConverZAP. Contact: contato@converzap.com.
- You can ask for access, correction, portability or deletion of your data. The deletion steps are on the data deletion page.
- The full rules, legal bases and the vendors that process data are in the Privacy Policy and the Terms of Use (in Portuguese).
Found a security issue?
Email contato@converzap.com with what you found and how to reproduce it. The contact is also in the site’s security.txt file.