Security Note

The platform provides conversational messaging, shared team inboxes, chatbot automation, AI-assisted customer support, campaign management, workflow automation, and integrations with third-party business applications.

It is designed for businesses of all sizes seeking secure, reliable, and scalable customer communication over WhatsApp.

Infrastructure is monitored continuously to detect operational issues, abnormal activity, and security events.

We collect only the information required to deliver our services, including account information, contact details, WhatsApp numbers, message content, media, templates, analytics, and operational logs.

Customer information is processed solely for providing, maintaining, securing, and improving the services requested by customers.

Customer data remains stored only for as long as necessary to provide the subscribed services or until deletion is requested, subject to applicable legal or contractual retention obligations.

Messages are retained for up to one year unless deleted earlier upon customer request. Message transmission and storage follow Meta's security protocols.

Encryption keys are managed through cloud-based Key Management Services (KMS) with controlled access and periodic key rotation.

Access to production systems and customer information is restricted to authorized personnel with a legitimate business need.

These controls help identify and remediate security issues prior to production deployment.

OAuth authentication and IP allowlisting are not currently supported.

These controls enable rapid detection and response to operational and security incidents.

Security incidents are investigated by the Incident Response Team led by Apoorv Chaturvedi, with support from Engineering, Infrastructure, and Product teams.

Customers are notified without undue delay whenever an incident materially impacts customer data, service availability, or platform security.

Customer data is backed up every 24 hours.

Backups are encrypted and retained for seven days.

Backup restoration is tested monthly to validate recovery procedures.

A documented Disaster Recovery Plan defines procedures for restoring services following major operational disruptions.

Business continuity procedures are maintained to minimize service disruption and ensure operational resilience.

Customers retain ownership of all data submitted, generated, or stored through the platform.

Emovur acts as a data processor solely for providing contracted services.

Customer accounts scheduled for closure are permanently removed from production systems within 30 days, subject to applicable legal or contractual retention requirements. Data portability is currently supported for customer data exports as available within the platform.

AI features are optional and enabled only when configured by customers.

Customer data is not used to train third-party AI models.

Where applicable, data processing agreements and contractual obligations govern the processing of customer information by third-party service providers.

Security vulnerabilities may be reported via email to the security team. Critical reports receive an initial response within 4 hours. Verified vulnerabilities are investigated in accordance with our Incident Response Policy.