Security and data: what we protect, and how.

Where your data lives

Data stored in UPPU (messages, contacts, media files and backups) stays on our own servers in our own data center in Istanbul.

WhatsApp, Messenger and Instagram messages pass through Meta's infrastructure by nature; our copy, media files and backups stay in Istanbul. Live chat data never goes to Meta or any other third party, and it doesn't leave UPPU unless you send it to your own systems by webhook.

The path a message takesUPPU onlyThrough Meta

Your visitorLive chat

Your customerWhatsApp, Instagram, Messenger

Never goes to Meta

Meta's infrastructureMessages pass through here

UPPU · IstanbulMessages, media files and backups

Our own data center

Signed webhook · HMAC-SHA256

Your systemsYour CRM, order or booking system

Encryption and secrets

• TLS on every domain (Let's Encrypt certificates, HTTP/2): connections are encrypted in transit.
• Meta access tokens and WhatsApp PINs are stored encrypted with AES-256-GCM, and each encrypted value is bound to its workspace and record.
• Your webhook endpoint addresses and signing secrets are stored encrypted too.
• Only a SHA-256 hash of each API key is stored; you see the key itself only when you create it.
• You can give keys scopes, a channel binding, an IP allowlist and an expiry, and rotate or revoke them.
• The Authorization header is never written to any log.

Access and accounts

• Four roles: Owner, Admin, Agent and Auditor. Auditors can only read; retention, API keys and webhooks are owner-only.
• Agents see customers' phone numbers masked (for example +90 *** 2233); owners, admins and auditors see the full number.
• Every user can turn on TOTP two-factor authentication and passkeys.
• UPPU's platform admins have no implicit access to your workspace data, and two-factor authentication is mandatory for their accounts.
• Sensitive pages ask for your password again. Login is limited to 5 attempts per minute, and lockouts are logged.
• A mandatory workspace filter applies to every query, and every route is tested across workspaces and roles.
• Teammates join by invitation or with your company's verified email domain; free email domains can't join that way.
• Data changes and security events go to the audit log, which is kept for at least 3 years. Passwords, codes, tokens and secrets are never written to any log.

Privacy tools

You are the data controller for your customers' and website visitors' data, and UPPU is your data processor. Built-in tools for your KVKK duties are in the panel.

• The workspace owner chooses a retention period from 30–730 days. Expired data is deleted every night at 07:15 (Istanbul time), and each run writes a destruction log that holds counts only.
• You can export all of a contact's data as JSON or erase it completely; to confirm an erasure you type the contact's label.
• An erasure is reported to your systems with the contact.erased webhook.
• Marketing templates need a recorded consent; anyone who replies STOP, DUR or İPTAL withdraws it, and the consent ledger records it.
• Consent for commercial messages and, in Türkiye, the İYS registry are your duties; UPPU has no İYS connection.

Retention periods

These are the product's current settings; when they change, this table changes too.

Reliability

• We test the system end to end every minute, along the real path; if the live chat path fails, our team is alerted within 1.5–2.5 minutes.
• A health check runs every 5 minutes, with a daily report.
• The database is backed up every night and backups are kept for 7 days; a 14-day binary log allows point-in-time recovery.
• We test restoring from backup every month.

Infrastructure

We don't publish our servers' names, addresses or software versions. These are the rules we apply:

• Only the required ports are open to the outside.
• Server management works by key only and from restricted addresses.
• The database and cache aren't reachable from outside.
• Security updates install automatically.
• The staging environment runs separately from production.

API and webhook security

• Webhooks are signed with HMAC-SHA256 in the Standard Webhooks format; we recommend refusing any request whose timestamp is more than 300 seconds off.
• Webhook targets pass SSRF protection: nothing is sent to private network ranges, the IP address is pinned, and redirects aren't followed.
• An endpoint goes live only after it passes a test event and a wrong-signature check.
• Webhooks come from 91.216.36.26, and we announce any change 30 days ahead. The real check is the signature.
• Sends require an Idempotency-Key: retry the same request safely, without duplicate messages.
• Browser requests to the API are refused (no CORS); API keys are only used from your servers.

Third parties

• No third-party analytics, trackers or CAPTCHA in the panel or the chat widget.
• Facebook's JavaScript library loads only on the panel's WhatsApp, Messenger and Instagram connection pages, while you connect a channel.
• Meta provides the WhatsApp, Messenger and Instagram channels; messages on those channels pass through Meta's infrastructure.
• The system emails UPPU sends (verification, invitations, alerts) never carry your customers' message text.
• This website (uppu.net) sets no cookies and loads nothing, fonts included, from third-party servers.
• The companies we use to provide the service are on our sub-processor list.

Certifications and SLA

Reporting a vulnerability

Documents

• Terms of Service and Data Processing AnnexRoles, instructions, security measures and sub-processors
• Sub-processorsThe companies we use to provide the service
• Privacy PolicyWhat data we process, why, and for how long
• KVKK privacy noticeUPPU's notice as a data controller under Turkish law
• Cookie PolicyBrowser storage on the site, in the panel and in the chat widget
• Data deletion instructionsHow Facebook, Instagram and WhatsApp users can delete data