Security and data protection at SyncBot

How your account is protected

• Passwords are hashed with bcrypt. Nobody at SyncBot can read them.
• Sign-in sessions use short-lived access tokens plus refresh tokens that are stored hashed and rotated on use.
• Repeated failed logins, password-reset requests and email codes are rate-limited.
• Resetting your password signs out every session on the account.
• Email verification codes expire after 10 minutes and lock after 5 wrong tries.

How your WhatsApp connection is protected

• SyncBot uses Meta’s official WhatsApp Business Cloud API.
• WhatsApp access tokens and app secrets are encrypted at rest with AES-256-GCM.
• Media your customers send is fetched from Meta through an authenticated SyncBot endpoint. Your browser never holds your WhatsApp token.

Team access

Owners and admins decide what each team member can see and do: which pages they can open, whether they see every chat or only their own, and whether they can send broadcasts, edit automation, manage the team or handle billing. Nobody can give someone more access than they have themselves.

Payments

Subscriptions are paid through Razorpay by UPI, card or netbanking. Card details are entered on Razorpay’s checkout and never reach SyncBot’s servers. SyncBot checks every payment with Razorpay before activating a plan.

Reporting a vulnerability

If you find a security problem, please email syncbotindia@gmail.com before disclosing it publicly. We reply within 3 working days. Our machine-readable contact is at syncbot.in/.well-known/security.txt.

Frequently asked questions