Soneka Security: Compliance, Encryption, and Privacy

​

Certifications and Compliance

​

Data Residency

​

Encryption

• In transit: All connections between your browser, Soneka’s APIs, and our infrastructure use TLS 1.3. Older protocol versions (TLS 1.0, 1.1) are rejected.
• At rest: All stored data — databases, backups, file attachments — is encrypted using AES-256. Encryption keys are managed via a dedicated key management service with automatic rotation.

​

Two-Factor Authentication (2FA)

​

IP Allowlist

1. Go to Admin → Settings → Security → IP Allowlist.
2. Add the IP addresses or CIDR ranges your team uses (e.g., your office IP, VPN exit nodes).
3. Click Save and Enable.

​

Audit Logs

​

Webhook Signatures

const crypto = require('crypto');

/**
 * Verify an incoming Soneka webhook request.
 *
 * @param {Buffer|string} rawBody       - The raw, unparsed request body.
 * @param {string}        signatureHeader - The value of the X-Soneka-Signature header.
 * @param {string}        secret        - Your webhook signing secret from Soneka settings.
 * @returns {boolean} true if the signature is valid, false otherwise.
 */
function verifyWebhook(rawBody, signatureHeader, secret) {
  // Strip the optional "sha256=" prefix that some proxies may add.
  const incoming = signatureHeader.startsWith('sha256=')
    ? signatureHeader.slice(7)
    : signatureHeader;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  // Use a constant-time comparison to prevent timing attacks.
  // Both buffers must be the same byte length, so compare after hex-encoding.
  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(incoming, 'hex');
  if (a.length !== b.length) return false;

  return crypto.timingSafeEqual(a, b);
}

​

WhatsApp Guardrails

• Scam and abuse filters scan outbound message content and flag patterns associated with phishing, financial fraud, and prohibited content categories before messages are sent.
• Quality score monitoring alerts you when your phone number’s Meta quality rating drops below a healthy threshold, giving you time to address opt-out spikes before a number gets flagged or banned.
• Opt-out enforcement automatically removes contacts who reply with standard opt-out keywords (STOP, UNSUBSCRIBE, etc.) from future broadcasts.

​

Data Deletion

• Active API tokens are destroyed instantly upon deletion request.
• Active database records are wiped within 30 business days.
• Encrypted backups are rotated and purged within 60 business days.

​

Reporting a Security Vulnerability