Security

We take the security of your business and customer data seriously. This page summarizes the main safeguards built into Repeat Grow.

Encryption

• All traffic between your browser and Repeat Grow is encrypted in transit over HTTPS/TLS.
• WhatsApp API access tokens are encrypted at rest using AES-256-GCM before being stored.

Access Controls

• Database access is enforced with row-level security policies on every table, scoping each account's data to that account.
• Team access within an account follows role-based permissions (owner / admin / agent / viewer).
• API keys are scoped and revocable, and are stored hashed rather than in plain text.

Webhook & Request Verification

Inbound WhatsApp webhook requests are verified using HMAC-SHA256 signature checks before being processed, so unsigned or spoofed requests are rejected.

Infrastructure

Repeat Grow is built on the official WhatsApp Business API and hosted on Supabase infrastructure, with baseline security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Content-Security-Policy, and a restrictive Permissions-Policy) applied to every response.

Responsible Disclosure

If you believe you've found a security vulnerability in Repeat Grow, please report it privately to support.repeatgrow@gmail.com rather than disclosing it publicly. We'll acknowledge your report and work with you to understand and address the issue.