Security & Trust

Last updated: August 1, 2026

This page is maintained by TIZYY to answer common security and privacy questions about the TIZYY platform. It describes the controls we operate today — it is not a certification, audit report, or third-party endorsement.

Access and authentication

Every TIZYY account is protected by email/password or Google sign-in. Sessions are issued and validated by our managed authentication provider. Business owners control who is invited into their workspace.

  • Role separation between regular accounts and administrator accounts.
  • Administrative roles are stored server-side and checked on every privileged request.
  • Sensitive credentials such as WhatsApp access tokens are never returned to the browser.

Tenant data isolation

TIZYY is multi-tenant. Contacts, conversations, templates, campaigns and analytics are scoped to the owning account and enforced at the database layer with row-level security policies, so one business cannot read or modify another business's data.

Encryption in transit

All traffic between your browser, TIZYY, and the Meta WhatsApp Cloud API is served over HTTPS/TLS. WhatsApp message delivery itself is handled by Meta's infrastructure under Meta's own security model.

Platform and hosting

TIZYY runs on managed cloud infrastructure with a managed Postgres database and edge-hosted application servers. Platform-level patching, backups and infrastructure hardening are handled by our hosting providers; application-level controls are maintained by TIZYY.

Secrets and integrations

Meta App credentials, WhatsApp access tokens and API keys are stored as server-side secrets. Developer API keys you generate in TIZYY are stored as hashes — the full key is shown only once at creation time.

  • Inbound webhooks from Meta are verified before processing.
  • Public API endpoints require a valid API key on every request.

Retention and deletion

Message history, contacts and campaign records are retained while your account is active so you can access your reporting. You can delete contacts, templates and campaigns from within the product at any time. To request full account deletion, contact us and we will remove your workspace data, subject to legal and accounting retention obligations. See our Privacy Policy for details.

Shared responsibility

Security of your WhatsApp messaging is shared between three parties:

  • Meta — WhatsApp Cloud API availability, message transport, and platform policy enforcement.
  • TIZYY — application security, tenant isolation, secret handling, and access control.
  • You — account credentials, who you invite, obtaining opt-in consent, and the content you send.

Report a security issue

If you believe you have found a vulnerability, please report it to us privately and give us reasonable time to respond before any public disclosure.

TIZYY Security

Email: [SECURITY_EMAIL@YOURDOMAIN.COM] — replace before publishing