Security & data handling
Whizo AI holds your agency's client data, conversations, and credentials. This page describes, plainly, what we have in place today — and what we're honest we don't have yet.
Encryption in transit
All traffic to and from Whizo AI is served over HTTPS with HSTS enabled (max-age one year, including subdomains, preload-eligible). Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers are applied sitewide.
Infrastructure
The backend runs on hardened AWS infrastructure. API servers and microservices are deployed through a blue-green process with zero-downtime cutover, and SSH access is restricted to authorized operators. Compute instances are isolated per service (API, WhatsApp, scraping engine).
Data residency
Application data is stored in Supabase (managed PostgreSQL) in the Asia-Pacific (Mumbai / ap-south-1) region. Uploaded media lives in an S3 bucket in the same region. Data does not leave this region for primary storage.
Role-based access control
Access inside every agency is enforced by a granular RBAC layer — viewer, designer, editor, manager, and SMM roles each carry a specific permission set, scoped per feature. A freelance designer can see the assets they need without touching another client's data or billing.
Client isolation
Each client gets a fully isolated workspace — its own tasks, content calendar, CRM, and files do not leak into another client's view. Sensitive client credentials can be stored in an encrypted Password Vault rather than passed around in plain text.
Content Security Policy
The application is delivered with a scoped Content-Security-Policy that restricts script, style, and frame sources to approved origins, blocks object embedding and mixed content, and upgrades insecure requests. Bot and crawler access is governed by a deliberate robots.txt policy.
Access control & authentication
Passwords are never stored in plaintext and accounts are protected against brute-force login attempts with failed-attempt lockouts. Users can enable passwordless login (magic link / email OTP) and two-factor authentication. Disabling 2FA requires re-authentication to prevent a compromised session from silently weakening an account.
Team members are invited into an agency at a specific role and can be removed immediately. Removed members are tombstoned (soft-deleted) rather than hard-purged on the spot, so access is revoked instantly while historical references stay intact.
Incident response & reporting
If you believe you've found a security vulnerability or experienced a data-related incident, report it immediately to support@whizo.ai. We treat responsible disclosure in good faith and prioritize confirmed reports.
Platform-level changes are tracked in our public changelog, and we operate automated blue-green deploys so a bad release can be rolled back without extended downtime.
What we don't claim
Whizo AI has not completed formal SOC 2 Type II or ISO 27001 certification audits. We don't list certifications we haven't earned. If these matter to your procurement process, contact us and we'll give you an honest status and timeline rather than a logo. This page intentionally describes real, verifiable controls — not aspirational ones.
Data retention & deletion
Your data belongs to you and can be exported at any time. When an agency account is cancelled, data is retained briefly to allow reactivation, then removed per our retention schedule. Orphaned media on workspace deletion is cleaned up through scheduled maintenance jobs. Full details are in our privacy policy.