Security
How we look after your accounts and data
What AutoDM does today to keep your Instagram, Facebook and WhatsApp accounts and your customers' messages safe. Plain facts, no badges.
Meta's official APIs, never your password
You connect Instagram and Facebook on Meta's own login page, and WhatsApp through Meta's WhatsApp Business Platform. AutoDM never asks for, sees or stores your Instagram or Facebook password.
Access tokens encrypted at rest
The access tokens Meta issues for your accounts are encrypted in our database with AES-256-GCM. Disconnecting an account deletes its token.
Every webhook's signature checked
Messages and events from Meta, and payment updates from Razorpay, are accepted only when their signature is valid. Anything else is rejected.
HTTPS
Traffic between your browser and AutoDM is encrypted with HTTPS.
Message text deleted after a retention period
Message text is removed automatically after a retention period, 365 days by default. Counts, orders and analytics stay, so your reports still work.
Data deletion on request
Disconnect an account to delete its token, or ask us to delete your workspace. People who messaged a business through AutoDM can ask for their data to be deleted too.
Roles and per-account access
Owners manage the plan, billing and connections. Members reply to customers, and owners choose which connected accounts each teammate can see.
Errors monitored
Errors in the app and in the background worker are recorded and alert our team, so we can see problems and fix them.
Payments handled by Razorpay
Plan payments and your customers' payments are processed by Razorpay. AutoDM doesn't receive or store card numbers.
AI by Anthropic's Claude, for three jobs only
The AI is Anthropic's Claude. AutoDM uses it only to write replies, check comments and translate messages.
What we don't claim
AutoDM doesn't hold SOC 2 or ISO 27001 certification and isn't a Meta Business Partner. Everything on this page describes how the product works today.
Found a security problem?
Please write to us at [security email] with the details. We'll reply and keep you updated while we fix it.