Last updated 23 August 2026
The short version
Encrypted in transit and at rest
All traffic is HTTPS with modern TLS. Data at rest sits on managed cloud storage with provider-side encryption, and access tokens for connected accounts are additionally encrypted by us with a key the database does not hold.
Your data is not training data
We do not use customer content to train our own models, and we use AI providers on terms that exclude training on our API traffic. Generated output belongs to the customer.
Tenants are separated by design
Every record is scoped to an account, and the WhatsApp platform enforces this at the database level — one open conversation per business number and customer, so two businesses cannot see the same thread.
Least access, and it is revocable
Staff access to production is limited to the people who need it, and every connected account can be disconnected from the product, which purges the stored token.
Controls in more detail
Infrastructure
- Services run on managed cloud infrastructure with network isolation between environments.
- Production and development are separate environments with separate credentials.
- Secrets are held in the platform's secret store, not in application code or configuration repositories.
- Automated backups of production databases, with restores exercised rather than assumed.
Application
- Authentication uses short-lived sessions; Let's Tok for WhatsApp authenticates by one-time code to a verified WhatsApp Business number.
- Incoming webhooks from Meta are verified against an HMAC signature computed over the raw request body, with no bypass in any environment.
- Rate limits sit in front of authentication endpoints, per identity, per address and globally.
- Authentication endpoints answer identically whether or not an account exists, so they cannot be used to enumerate customers.
Data handling
- Access tokens for connected social, ads and WhatsApp accounts are encrypted with a dedicated key and decrypted in exactly one service, so there is a single path to audit.
- Deleting an account removes its content and revokes its connected-account tokens.
- Message content in Let's Tok is retained to show the conversation history to the business that owns it, and is deleted with the account.
- We do not sell personal data, and we do not share it with advertisers.
People and process
- Production access requires individual named accounts with multi-factor authentication.
- Dependencies are monitored for known vulnerabilities and patched on a rolling basis.
- Changes reach production through version control and review, not manual edits on a server.
AI models and your content
Letstok is built on third-party foundation models as well as our own pipelines. That has specific consequences worth stating rather than burying.
- Prompts, uploaded assets and generated output may be sent to model providers to produce the result you asked for. That is the processing you are requesting when you press generate.
- We contract with those providers on terms that prohibit training on our traffic, and we do not train our own models on customer content.
- Model output can be wrong, and can resemble other output produced from a similar prompt. It is not a substitute for a human check before you publish an ad or send a legal or medical answer.
- Where a feature can act on your behalf — publishing a post, launching a campaign, replying to a customer — the product tells you which one it is and, in Let's Tok, always leaves a route to a human.
- Automated conversation in Let's Tok is deterministic by default. The AI answering layer is off unless a business turns it on for its own account.
Sub-processors
These vendors may process customer data on our behalf. The list is maintained here and in the privacy policy; if the two ever disagree, treat the privacy policy as authoritative and tell us.
| Vendor | Purpose | Region |
|---|---|---|
| Google Cloud Platform | Hosting, databases and media storage | EU / US |
| Meta Platforms | WhatsApp Business Cloud API, Facebook and Instagram publishing, ads | US |
| OpenAI | Text generation and assistance | US |
| Model and media providers | Video, image and voice generation | US / EU |
| Stripe | Payments and subscription billing | US / EU |
| Email delivery provider | Transactional email | US |
What we do not claim
Being explicit here is cheaper for both of us than finding out during a procurement review.
- We do not currently hold a SOC 2 Type II report.
- We are not currently ISO 27001 certified.
- We do not operate a public status page, so we do not publish uptime figures. Incidents affecting customers are communicated by email.
- We do not guarantee data residency in a specific country on the standard plans. If residency is a requirement for you, talk to us before you sign — it is an architecture question, not a settings question.
Reporting a vulnerability
If you have found a security issue, write to us before disclosing it publicly. We will acknowledge within two business days and keep you updated until it is closed.
security@letstok.com- Include the steps to reproduce, the impact you believe it has, and anything we need to see it ourselves.
- Please do not access, modify or retain data belonging to anyone else while testing, and do not run denial-of-service or spam tests against production.
- We do not run a paid bounty programme, and we will credit you if you want us to.