Security policy

• Basic identifiers: WhatsApp number, Messenger ID or other channel data.
• Messages: text, images, audio, video and their metadata.
• Inferred or requested data, such as name, ID or preferences, when the user chooses to share them.

A fast database keeps recent data and a data warehouse stores historical information for analytics. Both are encrypted with AES-256/AES-128. Backups run three times a week with 60-day retention, and disaster recovery has a 99.9% SLA.

• End users: access only their own data through official channels.
• Clients: OAuth2 authentication with roles, permissions and audit logs.
• IWAIT staff: minimal, temporary and approved access, recorded in immutable audit logs.
• Other systems: APIs with OAuth2.

We apply data loss prevention (DLP): sensitive patterns such as card or ID numbers are detected and tokenized before being stored or transmitted. Conversations pass through DLP before reaching generative models, and training documents are stored encrypted on Google Cloud.

• Secure HTTP REST calls.
• Firewalls with dedicated IPs.
• IPsec VPN between IWAIT's and the client's infrastructure.
• APIs encrypted at rest and in transit.

• Cloud firewalls with default deny.
• Perimeter DoS/DDoS protection.
• Regular patching and vulnerability testing.
• Centralized monitoring with real-time alerts.

Infrastructure follows GitOps practices and can be replicated in hours. In simulations, operations were restored in under 30 minutes.

• Low priority: 120 minutes.
• Normal priority: 24 hours.
• Severe priority: 24 hours, prioritized.

Every security change is logged, reviewed and approved before implementation.