1. Architecture
WhatsApp Messenger is built so that your business records stay in the system you already trust:
- Zoho CRM holds every message, contact, template and attachment, in your own organization and subject to your CRM permissions.
- Zoho Catalyst runs a small backend that holds encrypted access tokens and receives webhooks from Meta. It is not a second copy of your CRM.
- Meta WhatsApp Business Platform (Cloud API) delivers and receives the messages.
2. Data flow
| Action | Path |
|---|---|
| Outbound message | A user or workflow creates a message in Zoho CRM. It is sent to the Meta Cloud API over HTTPS, and the delivery status is written back to the CRM record. |
| Inbound message | Meta calls our webhook. We verify Meta’s signature, then record the message and any media against the matching CRM record. |
| Templates | Templates are imported from, or submitted to, your WhatsApp Business Account and stored in your CRM. |
3. Security controls
- All traffic is encrypted in transit with TLS 1.2 or higher.
- Access tokens and secrets are stored encrypted on our backend, never in CRM records, browser code or logs.
- Every incoming Meta webhook is verified with its signature before anything is processed.
- Requests from the CRM to our backend are HMAC-signed.
- Webhook processing is idempotent, so retries never create duplicate messages.
- CRM access follows your Zoho CRM roles, profiles and sharing rules.
- Staff access to production systems is limited to the people who need it, with multi-factor authentication.
- Operational logs are kept for 30 days and exclude message content where possible.
4. Sub-processors
| Provider | Purpose | Data |
|---|---|---|
| Meta Platforms, Inc. | WhatsApp message delivery and template management | Phone numbers, message content, media, statuses |
| Zoho Corporation | CRM data storage (Zoho CRM) and backend hosting (Zoho Catalyst) | All Customer Data, encrypted tokens, logs |
| RingCentral, Inc. | SMS delivery, only if a Customer enables SMS | Phone numbers, SMS content |
We will update this list and notify Customers before adding a new sub-processor that handles Customer Data.
5. Compliance
We follow the Meta Platform Terms, the WhatsApp Business Messaging Policy and Zoho’s Marketplace developer terms. Our hosting and storage providers maintain their own certifications (for Zoho, see Zoho’s compliance pages). A Data Processing Addendum is available on request at contact@aioautomations.com.
6. Incident response
If we become aware of a security incident affecting Customer Data, we will contain it, investigate, and notify affected Customers without undue delay, and within 72 hours where the law requires, with the information they need to meet their own obligations.
7. Report a vulnerability
Please email contact@aioautomations.com with the subject Security report. Do not access other customers’ data or disrupt the Service while testing. We will acknowledge your report within 3 business days.
For how we handle personal data, see our Privacy Policy.