Security

1. Access and sign-in

• Passwords are stored only as strong one-way hashes, with strength rules and checks.
• Two-factor sign-in, required for owners and admins before connecting numbers or inviting members.
• Five member roles with clear permissions, and per-number access.
• Sessions can be signed out everywhere, and resetting a password signs out every session.

2. Protecting data

• All traffic is encrypted in transit with TLS.
• Access tokens and other secrets are encrypted at rest with a separate master key.
• Every company's data is kept apart, and every query is scoped to the company.
• Regular backups of the database.

3. Logs and accountability

Important changes by members and by our staff are written to a hash-chained activity log, so tampering can be detected. Staff actions on customer accounts need a written reason.

4. Official platforms

WhatsApp numbers connect through Meta's official WhatsApp Business Platform, and incoming webhooks are verified with Meta's signature.

5. Reporting a problem

If you believe you have found a security issue, email support@dynastyinfinity.app with the details. Please give us reasonable time to fix it before sharing it, and do not access other people's data.