Message customers safely, and by the rules
WACRM security & compliance is the set of controls built into your WhatsApp CRM that helps growing teams message customers safely and by the rules: Meta's official WhatsApp Cloud API, consent and opt-out per channel, a personal sign-in for every teammate, an audit log of who changed what, and API keys that reach one project only.
By the WACRM team Updated
Built on Meta's official WhatsApp Cloud API
Opt-in recorded per contact and channel; STOP and other keywords opt a customer out
Own sign-in per teammate; billing, keys, webhooks and data export stay with the owner
Audit log of changes, filterable by person, action and date
API keys stored hashed, scoped, limited to one project and revocable at once
Why does WhatsApp messaging need security and compliance controls?
A WhatsApp number is where customers send names, addresses, appointment details and payment questions. When a team shares one phone or one password, nobody can say who read or sent what, consent lives in someone's memory, and access stays with whoever leaves.
Meta asks every business on the WhatsApp Business Platform to get opt-in before messaging and to respect opt-out requests. WACRM keeps those rules inside the product: consent sits on the contact, opt-outs are recorded per channel, and every person and every system has its own, limited access.
Customer on WhatsApp
Opted in, can opt out any time
WhatsApp Cloud API
Meta's official API
Your WACRM project
Isolated from every other project
Your team and systems
Own sign-in, roles, scoped keys
Audit log: who changed what, and when
How does WACRM keep your WhatsApp data under control?
Connect through Meta
You connect your number with Meta's own sign-up flow, and WACRM sends and receives through the official WhatsApp Cloud API.
Record consent
Opt-ins are stored per contact and channel with the date and source; broadcasts, template sends and automations skip anyone who has not opted in.
Give each person their own access
Invite staff with their own sign-in; the owner keeps billing, API keys, webhooks, team management and data export.
Review and export
Read the audit log in Settings, and export the project's contacts, conversations, messages and templates in one file whenever you need them.
What controls do you get?
Official Cloud API
WhatsApp messages are sent and received through Meta's WhatsApp Cloud API, connected with Meta's own sign-up flow.
Opt-out per channel
A reply such as STOP, UNSUBSCRIBE, BAJA or PARAR is recorded as an opt-out on that channel — WhatsApp, SMS, Messenger or Instagram — and later automated sends there stop.
Personal sign-ins and roles
Each teammate signs in with their own account. Staff work the inbox and contacts; billing, keys, webhooks, the team and export stay with the owner.
Audit log
Consent changes, sent messages, team, webhook and template changes, exports and erasures are logged with who and when.
Scoped, capped keys
Keys carry only the scopes you grant and are stored as a hash; a key for an AI tool can carry a monthly action cap.
Data export and erasure
The owner exports a project's data as one file, and a contact can be erased through the API when a customer asks.
Who needs this level of control on WhatsApp?
Clinics
Front-desk staff answer patients under their own sign-in, and the practice owner sees in the audit log who changed a contact or sent a message.
Agencies
Each client sits in its own project, and a project API key can never read another client's contacts.
Larger teams
IT and compliance reviewers get consent records, an audit trail, a full data export and scoped keys to check before rollout.
How does WACRM keep one project's data apart from another?
Every project in your workspace is a separate space for contacts, conversations and settings. A project API key works inside its own project only, and a request for a project the key does not own returns not found, never someone else's records. Agencies run one project per client for exactly this reason.
Can our security team review WACRM before rollout?
Yes. Talk to sales and our team walks your IT or compliance reviewers through how access, consent, logging, keys and data export work, and answers your security questionnaire. If you need a control the product does not include, our engineers can scope it with you as custom development.
Questions about security and compliance in WACRM?
Does WACRM use the official WhatsApp API?
Yes. WACRM connects your number through Meta's sign-up flow and sends and receives WhatsApp messages through Meta's official WhatsApp Cloud API.
What happens when a customer replies STOP?
WACRM records an opt-out for that contact on the channel the customer used, and later broadcasts and automated messages on that channel stop. The keyword list covers English, Spanish, Portuguese and Vietnamese words such as STOP, UNSUBSCRIBE, BAJA and PARAR.
Can I see who changed a setting or sent a message?
Yes. The audit log in Settings records actions such as consent changes, sent messages, team and webhook changes and data exports with the account and the time, and you can filter it by person, action and date.
Can we export or delete our customer data?
Yes. The owner exports the project's contacts, conversations, messages and templates as one file from Settings, and a single contact can be erased through the API when a customer asks to be forgotten. Both are written to the audit log.
How are API keys protected?
Keys are stored as a hash, not in plain text, carry only the scopes you grant and reach one project. A key for an AI tool can carry a monthly action cap, and revoking a key stops it at once.
Are webhooks to our own systems signed?
Yes. Every outbound webhook delivery carries an X-WACRM-Signature header, an HMAC-SHA256 signature your server checks with its own secret, and you can rotate that secret at any time.
Talk to an expert
A person from the WACRM team replies.
Ask for a security review: our team walks your IT or compliance reviewers through access, consent, logging and data export.
Replies within one working day, usually sooner on WhatsApp.
Roll out WhatsApp with the controls in place
Get started, or talk to sales to arrange a security review for your team.