How Authevo protects your users
Security isn't something we bolt on — it's how the API is built. Here is exactly what happens to the phone numbers, codes, and credentials that pass through Authevo, described plainly and without overselling.
Identifiers & codes
Phone numbers are hashed
Every phone number is hashed with SHA-256 — salted with a server-side secret — before it touches storage. The raw number is used only in memory to deliver the message; it is never written to a database or a log.
One-time codes are never stored in the clear
Verification codes are generated with a cryptographically secure random source, kept only as a salted SHA-256 hash, checked in constant time, expired after five minutes, and cleared the moment they are used.
Kept only as long as needed
Verification records are automatically purged after 30 days. We keep the minimum required to run and bill the service — nothing more.
Credentials & connections
WhatsApp tokens encrypted at rest
When you connect your own WhatsApp Business account, its access token is encrypted with AES-256-GCM authenticated encryption before it is stored. The encryption key is mandatory in production and never leaves the server.
API keys stored as hashes
Your secret key is shown once at creation and stored only as a SHA-256 hash. Rotating a key gives you a short overlap window, so you can roll it without downtime.
Signed webhooks
Every webhook we send carries an X-Authevo-Signature header: an HMAC-SHA256 of the exact payload, keyed by a per-account secret you control and can rotate — so your server can confirm the call really came from us.
Platform & abuse protection
Encrypted in transit
All API traffic is served over HTTPS/TLS. Your secret key travels only between your backend and ours.
The Safety Floor
Layered rate limits and abuse detection watch for runaway spend and suspicious traffic — per number, per account, and per address — and throttle it before it costs you. It runs automatically, with nothing to configure.
Hardened outbound requests
Webhook delivery is protected against SSRF: we pin the resolved address and refuse to call private, internal, or cloud-metadata ranges.
Least-privilege data access
Application data sits behind default-deny row-level security, so a single leaked key cannot read across the system.
What we don't claim
We would rather be precise than impressive. Confidentiality comes from the hashing and encryption above, together with our cloud platform's disk encryption — not from a hardware security module or a managed key service. We don't hold formal security certifications yet, and we won't claim controls we haven't built. WhatsApp's own end-to-end encryption is Meta's, not ours.
Reporting a vulnerability
Found something? We want to hear from you. Email security reports to support@authevo.dev and we'll respond quickly. Please give us a reasonable chance to fix an issue before disclosing it publicly.
For exactly what data we collect and why, read the Privacy Policy.
Authevo is a verified Tech Provider on Meta's WhatsApp Business Platform. Not affiliated with, or endorsed by, Meta.