Secure proxy
All communication with the WhatsApp layer goes through the platform as an intermediary. Infrastructure credentials are never exposed to the browser or to your code. You talk to our API, not directly to the layer underneath.
Security and privacy
How we protect your data and credentials
Running WhatsApp at scale and handling balance calls for care with security. Here are the principles behind the ZapZap API architecture and what falls to you as the data controller.
Key-based authentication
The public API uses a key and a secret per instance (x-api-key and x-api-secret). The dashboard uses short-lived session tokens with automatic renewal. You can revoke and rotate access whenever you want.
Per-account isolation
Each account sees only its own numbers, transactions and data. Requests are validated to make sure an instance belongs to whoever is using it before any operation runs.
Payments through established gateways
Top-ups go through established payment gateways. The platform works with prepaid balance and does not store sensitive card data on our servers.
Frequently asked questions
Do you have access to my conversations?
The platform mediates sending and receiving in order to apply humanization and security, and to deliver events by webhook to your system. Handle the data you move with care and follow data protection best practices with your contact base, since you are the controller of your customers' data.
How does this relate to data protection law (LGPD)?
Brazil's LGPD applies to contacting people. As a customer, you are the controller of your base: you need a legal basis to message someone, such as consent or a business relationship. ZapZap acts as the technical intermediary for delivery and does not define the legal basis or the content of your messages.
Are my API credentials exposed?
No. The instance key and secret stay on your side and you send them in request headers. The infrastructure credentials of the WhatsApp layer are never revealed to the frontend or returned in API responses.
Do you have a security program?
Yes. We keep a channel for responsible vulnerability reporting. Taking security seriously is part of running a platform that handles balance and business communication.
Start now
Create your account, connect a number in minutes and test the API with warm-up and anti-ban. R$15 per active number/month, prepaid, no lock-in.