Security

How a message flows

• Your customer writes to your business number on WhatsApp. Meta’s WhatsApp Business Platform delivers the message to Borhan’s servers on Cloudflare.
• Borhan checks the message’s signature, so only genuine messages from Meta are accepted.
• The message is stored in your business’s own isolated store. Photos and voice notes are saved there too, and voice notes are transcribed.
• Borhan writes a reply from your catalog, prices and rules. The text it needs goes to an AI model through Cloudflare’s AI Gateway, only to providers that don’t train on it or keep it.
• Fixed safeguards check the reply before it’s sent: prices must match your catalog, no unapproved discounts, no delivery promises. A request for a person always reaches you.
• The reply goes back through Meta to your customer, and alerts reach your personal WhatsApp.

Protection

• Encryption in transit (TLS) on every connection, and at rest in storage.
• Each business’s data lives in its own isolated store, reachable only through that business’s signed-in session. There is no shared table to leak across.
• Sign-in with Google. Owners and staff have different permissions.
• Secrets are kept in Cloudflare’s encrypted secret storage, never in our code.
• Logs leave out message content, and phone numbers in them are masked. Error reports don’t collect message content or contact details.
• Public endpoints are rate-limited, and forms are protected by Turnstile.

Retention and deletion

Conversations are kept for 12 months by default, and each business can change that. Deleted data leaves our backups within 30 days. To delete data, see the deletion section of our Privacy Policy.

Reporting a problem

If you find a security issue, please write to hello@borhan.one with “Security” in the subject. We will reply quickly and keep you updated.