Security
Security at SyncZap
How SyncZap isolates each organization's data, protects WhatsApp credentials, stores tokens only as hashes and requires confirmation before every send.
SyncZap connects your organization's WhatsApp to the dashboard and to the AI assistants you authorize. This page summarizes how data is kept apart and what each part of the system can see. The legal details are in the Privacy Policy.
Each organization isolated
- Each number of each organization has its own database, WhatsApp session and directory on the sync server.
- Every request is authorized on the server, by the user's membership in the organization. Roles and identifiers sent by the browser are not accepted as proof.
- The platform console shows administrative data and counts, not conversation content.
WhatsApp credentials stay in the engine
- The linked-device session lives only on the sync server. It never goes to the browser, the dashboard or AI assistants.
- The dashboard talks to the sync server through HMAC-signed calls with an expiry and replay protection.
- Passwords and session, OAuth and invitation tokens, as well as API keys, are stored only as hashes. The full API key is shown only when created; webhook secrets are stored encrypted.
- All traffic uses HTTPS, and transactional emails are sent with mandatory TLS.
You choose what is saved
- Only conversations with active sync are saved, shown and read by assistants. An owner or admin can turn on Sync all conversations, which skips WhatsApp's system feeds.
- Turning off sync for a conversation stops saving it, and what was already saved is no longer shown or read by assistants. Erase everything immediately removes the number's saved messages and files.
- Photos, voice notes, videos and documents stay on the phone. When someone opens an attachment or asks the AI to read it, SyncZap downloads a temporary copy that is deleted from the server 24 hours after the download. Transcripts and readings are kept as text.
- Voice notes and images sent for transcription or reading go to the Google Gemini or OpenAI API, contracted without use of the data to train models.
AI assistants receive only what they ask for
- ChatGPT, Claude and other MCP clients connect over OAuth 2.1 with PKCE. Each authorization covers one organization you choose, and the token only works for the SyncZap MCP server.
- Reading (whatsapp:read) and sending (whatsapp:send) are separate permissions. Only an owner or admin can grant sending.
- SyncZap sends nothing to the assistant on its own: the assistant receives only the results of the tools it calls, and only from synced conversations. WhatsApp credentials are never sent.
- Names, messages and captions are third-party content, delivered as data and never as instructions.
Audit and account
- Administrative actions are recorded in the audit log: invitations, permissions, integrations, sync options and deletions.
- Invitations have a recipient, an expiry and a single use. API keys belong to one organization and have their own permissions.
- We don't use conversation content for advertising or to train AI models.
Sending requires confirmation
1. Prepare
The assistant prepares the message with the exact recipient and text. Preparing sends nothing.
2. Show
The assistant shows you who it goes to and what will be sent.
3. Confirm
Only after your explicit confirmation is it sent, with a code valid only for that recipient and that text.
- Each send has an idempotency key: repeating the same key does not send the message twice, and an unknown result never triggers a new automatic send.
- Accepted means WhatsApp accepted the message, not that it was delivered or read.
- Marking as read and reacting with an emoji need no confirmation, but only work on synced conversations. The contact may see the read receipt and the reaction.
- Automatic transcript delivery is optional and turned on by an owner or admin: SyncZap sends the text of each received voice note to your Message yourself chat or as a reply in the same conversation, where the contact sees it too. Groups are left out unless Include groups is on, and each voice note produces at most one send.
Report a security issue
Found a vulnerability? Write to support@synczap.ai with the steps to reproduce it. See also the Privacy Policy and the Terms of use.