> ## Documentation Index
> Fetch the complete documentation index at: https://docs.soneka.africa/llms.txt
> Use this file to discover all available pages before exploring further.

# Soneka Security: Compliance, Encryption, and Privacy

> Soneka is SOC 2 Type II, ISO 27001, and GDPR compliant. Learn how data is encrypted and protected, and how to enable 2FA, IP allowlists, and audit logs.

Soneka is built for businesses that handle sensitive customer conversations at scale. Security and compliance are not afterthoughts — they are embedded into the platform's architecture from the ground up. This page documents the controls, certifications, and features available to every Soneka workspace.

## Certifications and Compliance

<CardGroup cols={2}>
  <Card title="SOC 2 Type II" icon="shield-check">
    Soneka is audited annually against the AICPA Trust Services Criteria covering security, availability, and confidentiality. Our most recent report is available to Enterprise customers under NDA.
  </Card>

  <Card title="ISO 27001" icon="certificate">
    Our information security management system (ISMS) is certified to ISO/IEC 27001, demonstrating systematic controls over how data is managed, stored, and protected.
  </Card>

  <Card title="GDPR" icon="scale-balanced">
    Soneka is fully compliant with the Kenya and EU General Data Protection Regulation. We act as a data processor under your instructions and provide a Data Processing Agreement (DPA) to all customers on request.
  </Card>

  <Card title="HIPAA-Eligible" icon="hospital">
    Soneka's infrastructure supports HIPAA-eligible workloads. Healthcare customers on Enterprise can request a Business Associate Agreement (BAA) from their account manager.
  </Card>
</CardGroup>

<Note>
  To request a copy of our SOC 2 report, ISO certificate, standard DPA, or BAA, email [**legal@soneka.africa**](mailto:legal@soneka.africa) with your workspace name and company details.
</Note>

## Data Residency

By default, Soneka stores data in our primary region. Enterprise customers can choose a dedicated data residency region to satisfy local data sovereignty requirements:

| Region                 | Availability |
| ---------------------- | ------------ |
| **Europe (EU)**        | Enterprise   |
| **United States (US)** | Enterprise   |
| **South Africa**       | Enterprise   |

Data residency means your workspace data — contacts, messages, templates, and logs — is written to and stored exclusively within the selected region. To configure data residency, raise a request with your account manager before your workspace is provisioned; region selection cannot be changed after setup.

## Encryption

All data in Soneka is encrypted both in transit and at rest.

* **In transit:** All connections between your browser, Soneka's APIs, and our infrastructure use **TLS 1.3**. Older protocol versions (TLS 1.0, 1.1) are rejected.
* **At rest:** All stored data — databases, backups, file attachments — is encrypted using **AES-256**. Encryption keys are managed via a dedicated key management service with automatic rotation.

## Two-Factor Authentication (2FA)

Enabling 2FA on your account is strongly recommended and takes less than two minutes.

<Steps>
  <Step title="Open Security Settings">
    Go to your **Profile → Security → Two-Factor Authentication**.
  </Step>

  <Step title="Choose Your Method">
    Select either an **authenticator app** (Google Authenticator, Authy, 1Password, etc.) or **SMS** as your second factor. Authenticator apps are more secure and recommended.
  </Step>

  <Step title="Scan the QR Code">
    If using an authenticator app, scan the QR code displayed on screen. Enter the 6-digit code from your app to confirm the pairing.
  </Step>

  <Step title="Save Your Backup Codes">
    Soneka will display 8 one-time backup codes. Store these somewhere safe (a password manager is ideal). These codes let you access your account if you lose your second-factor device.
  </Step>
</Steps>

<Tip>
  Workspace owners can **enforce 2FA for all team members** from **Admin → Settings → Security → Require 2FA**. Team members who have not yet enabled 2FA will be prompted to do so on their next login.
</Tip>

## IP Allowlist

Restrict Soneka workspace access to specific IP addresses or CIDR ranges. When an allowlist is active, login attempts from any IP not on the list are blocked — even with valid credentials and a valid 2FA code.

To configure the allowlist:

1. Go to **Admin → Settings → Security → IP Allowlist**.
2. Add the IP addresses or CIDR ranges your team uses (e.g., your office IP, VPN exit nodes).
3. Click **Save and Enable**.

<Warning>
  Make absolutely sure your own current IP address is on the allowlist before enabling it, or you will lock yourself out. If you do get locked out, contact [**connect@soneka.africa**](mailto:connect@soneka.africa) immediately — our support team can disable the allowlist after identity verification.
</Warning>

## Audit Logs

Every action taken inside your Soneka workspace is recorded in the audit log: logins, contact edits, flow changes, broadcast launches, permission changes, API key creation, and more.

| Plan                 | Audit Log Retention |
| -------------------- | ------------------- |
| Starter, Growth, Pro | 12 months           |
| Enterprise           | 24 months           |

To access audit logs, go to **Admin → Settings → Audit Log**. Logs can be filtered by user, date range, and action type, and exported as CSV or JSON.

## Webhook Signatures

Every webhook event dispatched by Soneka includes an `X-Soneka-Signature` header containing an HMAC-SHA256 signature of the request body. Verifying this signature ensures the request genuinely originated from Soneka and has not been tampered with in transit.

```javascript theme={null}
const crypto = require('crypto');

/**
 * Verify an incoming Soneka webhook request.
 *
 * @param {Buffer|string} rawBody       - The raw, unparsed request body.
 * @param {string}        signatureHeader - The value of the X-Soneka-Signature header.
 * @param {string}        secret        - Your webhook signing secret from Soneka settings.
 * @returns {boolean} true if the signature is valid, false otherwise.
 */
function verifyWebhook(rawBody, signatureHeader, secret) {
  // Strip the optional "sha256=" prefix that some proxies may add.
  const incoming = signatureHeader.startsWith('sha256=')
    ? signatureHeader.slice(7)
    : signatureHeader;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  // Use a constant-time comparison to prevent timing attacks.
  // Both buffers must be the same byte length, so compare after hex-encoding.
  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(incoming, 'hex');
  if (a.length !== b.length) return false;

  return crypto.timingSafeEqual(a, b);
}
```

Your webhook signing secret is available in **Admin → Settings → Developers → Webhooks**. Rotate it at any time if you suspect it has been compromised.

## WhatsApp Guardrails

Soneka includes built-in filters to protect your WhatsApp Business Account quality rating and keep your workspace compliant with Meta's messaging policies:

* **Scam and abuse filters** scan outbound message content and flag patterns associated with phishing, financial fraud, and prohibited content categories before messages are sent.
* **Quality score monitoring** alerts you when your phone number's Meta quality rating drops below a healthy threshold, giving you time to address opt-out spikes before a number gets flagged or banned.
* **Opt-out enforcement** automatically removes contacts who reply with standard opt-out keywords (STOP, UNSUBSCRIBE, etc.) from future broadcasts.

## Data Deletion

You have three ways to permanently delete your workspace data:

<AccordionGroup>
  <Accordion title="Delete via Facebook App Permissions">
    Go to your **Facebook Business Settings → Business Integrations** and revoke Soneka's app permissions. This immediately destroys all active API tokens and triggers the data deletion pipeline.
  </Accordion>

  <Accordion title="Delete via Email Request">
    Email [**support@soneka.africa**](mailto:support@soneka.africa) with the subject line "Data Deletion Request" and include your workspace name and the email address associated with your account. Our team will confirm the request within one business day.
  </Accordion>

  <Accordion title="Delete via Workspace Settings">
    Go to **Admin → Settings → Account Profile → Delete Account & Workspace**. You will be asked to type your workspace name to confirm. This action is irreversible.
  </Accordion>
</AccordionGroup>

**Deletion timeline:**

* Active API tokens are destroyed **instantly** upon deletion request.
* Active database records are wiped within **30 business days**.
* Encrypted backups are rotated and purged within **60 business days**.

## Reporting a Security Vulnerability

Soneka runs a **responsible disclosure bug bounty program**. If you discover a security vulnerability in our platform, please report it to [**security@soneka.africa**](mailto:security@soneka.africa) before any public disclosure. Include a description of the issue, steps to reproduce, and your contact details. We acknowledge reports within 24 hours and aim to resolve critical issues within 72 hours. Researchers who follow responsible disclosure guidelines are eligible for recognition and rewards.