Security at Instant Reply
Instant Reply encrypts stored channel tokens with AES-256-GCM, verifies Meta and Stripe webhook signatures, and scopes every request to an organization. It does not claim SOC 2, ISO 27001, or HIPAA.
Every control on this page was checked against our code. If we could not check it, it is not here.
Last verified: October 2, 2026
Controls we have verified
Organization-scoped access
API requests carry an organization ID, and the backend checks that the signed-in user belongs to that organization and holds a permitted role (owner, admin, or member) before it runs the action. Billing portal access is limited to owners and admins.
Encrypted integration secrets
Tokens and credentials we store for connected channels and tools are encrypted with AES-256-GCM, using a random salt per value and a key derived with PBKDF2. The key lives in server configuration, not in the database.
Verified inbound webhooks
Meta webhooks are checked against the X-Hub-Signature-256 header with HMAC-SHA256 and a constant-time comparison. Stripe webhooks use Stripe's signature check. Verified events are written to a durable journal before they are processed, and repeated Stripe events are ignored by event ID.
Sign-in and sessions
Session cookies are HttpOnly, SameSite=Lax, and Secure in production. Users can turn on authenticator-app (TOTP) two-factor sign-in in their settings. Sign-in, sign-up, password changes, and account deletion are written to a security event log.
Browser and transport protections
The site and API send HSTS, a Content-Security-Policy, X-Content-Type-Options, a Referrer-Policy, and a Permissions-Policy. State-changing browser requests need a signed CSRF token, and the production cookie uses the __Host- prefix.
Outbound request safety
When the app fetches a URL a customer supplies, such as a webhook endpoint, it uses a fetch helper that blocks private and internal IP ranges, limits redirects to three, and enforces a timeout.
Database row-level security
Row-level security is enabled on the tables in our database schema, so a query that skips the application layer still has to pass the database policies.
Rate limits and log hygiene
A global rate limiter sits in front of the API, with tighter limits on sign-in, sign-up, and the contact form. Server logs redact authorization headers, cookies, tokens, passwords, and message bodies.
Your data and who handles it
Retention periods, subprocessors, and your rights are set out in our policies. Read the Privacy Policy, the Data Processing Agreement for the subprocessor list, and the data deletion page to request removal. For how Instant Reply connects to Meta without scraping, see About.
What this page does not claim
We have no evidence in our code or ops documents for the items below, so we do not state them.
- SOC 2, ISO 27001, or HIPAA certification or attestation.
- A published penetration test report.
- An uptime SLA or a disaster recovery objective.
- A named hosting region. Hosting providers are listed in our Privacy Policy and Data Processing Agreement.
- SAML single sign-on. Sign-in is by email and password, or Google, with optional TOTP two-factor.
Security questions
Are my WhatsApp and Instagram access tokens encrypted?
Yes. Tokens and credentials we store for connected channels and tools are encrypted with AES-256-GCM, using a random salt per value, before they are saved to the database.
Does Instant Reply have SOC 2, ISO 27001, or HIPAA certification?
This page does not claim any of them. It lists only controls we have checked in our code. If your security review needs a certification, email security@instantreply.co before you buy.
Is two-factor authentication available?
Yes. Users can turn on authenticator-app (TOTP) two-factor sign-in in their settings. When it is on, sign-in asks for the extra code. SAML single sign-on is not currently offered.
How do you verify webhooks from Meta and Stripe?
Meta webhooks are checked against the X-Hub-Signature-256 header with HMAC-SHA256 and a constant-time comparison. Stripe webhooks use Stripe's signature check. Verified events are stored before processing, and repeated Stripe events are ignored by event ID.
Where is my data hosted, and who else processes it?
Application hosting, the database, and caching run on Microsoft Azure, as our Privacy Policy states. Our Data Processing Agreement lists every subprocessor, including the AI model providers used when AI features are on.
How do I report a security vulnerability?
Email security@instantreply.co. The same contact is published in our security.txt file at /.well-known/security.txt.
Report a vulnerability
Email security@instantreply.co with the affected URL, steps to reproduce, and the impact you see. Our security.txt file lists the same contact. Please do not access other customers' data while testing.