Company · Security
Security, described plainly.
What we do today, what you control, and how to report a problem. Everything on this page describes how Pinnaki works now.
Last updated
01What we do
What we do with the secrets you give us.
Passwords, keys and tokens are never stored as you typed them, and every request from outside is checked before it is trusted.
- Passwords are hashed
- Passwords are stored as bcrypt hashes. Nobody at Pinnaki can read your password.
- Tokens are encrypted
- The access tokens of the accounts you connect, such as Meta, Telegram bots, Shopify, WooCommerce, Razorpay and Google, are encrypted with AES-256-GCM before they are stored.
- Your AI keys stay yours
- A Gemini, OpenAI or Anthropic key you add is stored encrypted and shown only by its last four characters.
- API keys are kept as hashes
- A developer API key is shown once, when you create it. After that Pinnaki keeps only its hash, so a lost key is replaced, not recovered.
- Meta’s webhooks are verified
- Messages and events from Meta are accepted only when their X-Hub-Signature-256 signature matches. Without a valid signature, the request is refused.
- Signed API requests
- Requests to the developer API can be signed with HMAC-SHA256 over a timestamp and the body. A request older than five minutes, or one sent twice, is refused.Developer API
- Signed webhooks to you
- Webhooks Pinnaki sends to your server carry an X-Signature-256 header made with your signing secret, so you can check they came from us.
02What you control
What you control.
Who can see what, which keys exist, who gets your messages and when your data is deleted.
- Roles
- Everyone you invite is an admin, a manager or an agent. Agents work their own chats, plus unassigned chats that need a person when the workspace allows it.Team inbox
- API keys From Professional
- Limit each key to a list of IP addresses and templates, set an expiry, and change its rate limit (10 requests a second by default). Regenerate or revoke a key, or rotate the webhook signing secret, at any time.
- Opt-out keywords
- Set the words that opt a contact out, and back in. People who opt out, or turn off marketing messages in WhatsApp, are left out of later campaigns.
- Closing the workspace
- Closing starts a grace period, 14 days by default, during which you can cancel. Then the workspace’s data is deleted. Any wallet balance left is forfeited, and the app asks you to confirm that first.
03Report a problem
Found a vulnerability? Tell us.
Write to us before you tell anyone else, so we can fix it.
Send the details to support@pinnaki.com: what you found, the steps to reproduce it, and the workspace or URL involved. Please don’t access other people’s data or disrupt the service while you test.
Start on the Free plan.
Connect one WhatsApp number on Free. From Basic, invite your team and give each person a role.
Free: ₹0 a month. The developer API comes with Professional, ₹3,499 a month + GST.