Identity
Organization access follows the authenticated session.
Role and membership checks protect tenant resources before business data is read or changed.
Server enforced
TRUST Security architecture
Control is designed into
every sensitive boundary.
Customer messages, imported knowledge and external webhooks are treated as untrusted input. Organization access is resolved server-side, not accepted from the browser.
Tenant isolation Encrypted tokens Signed webhooks Audited actions
IdentitySession + role
SecretsEncrypted
IngressSigned
AuditRecorded
Boundary checks active
LIVE SEQUENCE · 01/03IDENTITY
01 Inside the system
Real surfaces.
Connected decisions.
Each capability is part of one operational chain, so customers never feel the seams between a message, a rule, a calendar and your team.
Secrets
Integration credentials remain server-side.
Long-lived provider tokens are encrypted at rest with key-version metadata and excluded from client payloads.
AES-GCM
Ingress
Webhook signatures and payload limits are verified.
Inbound provider events are authenticated, bounded and routed only after the destination phone number is resolved.
Signature checked
→ Start immediately
Your first connection starts
inside the workspace.
Create an account, follow the activation path and connect your WhatsApp Business number—no demonstration request required.
Create workspaceOrganization and owner
Connect WhatsAppAuthorize business number
Add business rulesServices, hours and knowledge
04
Test and activateInbound message health check