Security

Wexio implements a comprehensive, multi-layered security architecture to protect your data and ensure compliance with global data protection regulations. This page provides an overview of the security measures in place across the platform.

Encryption

Multi-Layered Encryption

All sensitive data in Wexio is encrypted using AES-256-GCM, the industry-standard encryption algorithm. The platform uses a per-organisation, per-context key derivation system to ensure maximum security isolation.

Key derivation follows RFC 5869 (HKDF) with SHA-512, meaning each organisation gets unique encryption keys derived from a master secret. This ensures that even if one key were compromised, other organisations and contexts remain protected.

Encryption Contexts

Different types of sensitive data are encrypted with separate, context-specific keys. See Integrations for connecting channels and AI Settings for AI provider configuration.

Each encryption operation includes Additional Authenticated Data (AAD) binding the ciphertext to its organisation and context, preventing context confusion attacks where encrypted data could be moved between organisations.

Data in Transit

All data transmitted between your browser and Wexio servers is protected by:

• TLS 1.2 / TLS 1.3 encryption on all connections
• Modern cipher suites only (ECDHE-based)
• Automatic HTTP → HTTPS redirect
• HSTS (HTTP Strict Transport Security) with a 1-year max-age

WebSocket connections (used for real-time chat updates) are also encrypted via WSS (WebSocket Secure).

Infrastructure Security

Wexio's infrastructure is hosted on enterprise-grade cloud platforms with robust physical and network security controls. All infrastructure components are deployed in compliance with SOC 2 Type II and ISO 27001 certified environments.

• Network segmentation — Production, staging, and development environments are strictly isolated using Virtual Private Clouds (VPCs) with granular security group rules. No direct internet access to backend services.
• DDoS protection — Multi-layer DDoS mitigation through AWS Shield and Vercel's edge network with automatic traffic scrubbing and rate limiting at the edge.
• Continuous monitoring — Real-time infrastructure monitoring with automated alerting for anomalous activity, resource utilisation, and security events.

Network Security

CORS Policy

Wexio enforces a strict Cross-Origin Resource Sharing (CORS) policy. Only requests from trusted *.wexio.io origins and authorised local development servers are accepted — all other origins are rejected.

Security Headers

The platform sets robust security headers on all responses:

WebSocket connections use WSS (encrypted WebSocket) with the same JWT authentication as HTTP requests, preventing unauthenticated real-time connections.

Data Isolation & Multi-Tenancy

All organisations share a common platform by default, with strict logical isolation at the database level. For customers with advanced compliance requirements, Pro and Enterprise plans offer the option to provision a completely dedicated MongoDB database and Redis instance for full physical data separation.

• Tenant-scoped queries — A middleware layer automatically injects the authenticated organisation ID into every database operation, preventing cross-tenant data leakage even in the event of application-level bugs.
• Dedicated database option — Organisations on Pro and Enterprise plans can migrate to a physically isolated MongoDB instance and/or Redis, with full data migration or fresh-start modes.
• Environment separation — Production, staging, and development environments are completely isolated. Testing never uses production data.
• Organisation deletion cascade — When an organisation is removed, all associated data (messages, media, integrations, flows, contacts) is permanently deleted across all storage layers.

Authentication & Authorization

Authentication Methods

Wexio supports multiple authentication methods to suit your security requirements. No passwords are stored on the platform — all authentication is handled through secure OAuth 2.0 providers, passkeys, or enterprise SSO. See Account Security for setup instructions.

Sessions

JWT access tokens (short-lived) with refresh token rotation. Database-backed sessions with 30-day expiry and device fingerprinting, ensuring that each login is tracked and can be individually revoked. Google reCAPTCHA is applied on all public-facing forms for bot detection and abuse prevention.

Role-Based Access Control (RBAC)

Every user in an organisation is assigned a role that determines their permissions. See Team Settings for role management.

Organisation Isolation

Every database query is automatically scoped to your organisation — users can never access data from other organisations, ensuring complete data isolation. Every GraphQL resolver is protected by layered guards: JWT authentication, organisation access, chat-level access, role verification, and plan usage limits.

Enterprise SSO (SAML 2.0)

Enterprise organisations can authenticate users through their own Identity Provider using SAML 2.0. See Account Security for SSO setup.

Input Validation & Injection Prevention

GraphQL Security

All API inputs are validated through multiple layers:

• Schema-level validation — Type checking enforced by the GraphQL schema
• DTO validation — All input fields validated with strict rules (length limits, format checks, type constraints)
• Query depth limiting — Maximum 12 levels of nesting to prevent recursive query abuse
• Introspection disabled in production — API schema not exposed to potential attackers

Injection Prevention

• NoSQL injection — All user-provided search patterns are escaped before use; no dangerous operators are exposed
• XSS protection — HTML content is filtered through strict allowlists, permitting only safe formatting tags
• Input length limits — All text inputs have maximum length constraints

Webhook Verification

All incoming webhooks from third-party providers are cryptographically verified. See Integrations for channel setup.

Rate Limiting & Spam Protection

Wexio implements a comprehensive, multi-layered rate limiting and spam protection system to protect both the platform and your end users from abuse. See Spam Protection Settings for configuration.

Rate Limiting Layers

Inbound Spam Protection

When end users send excessive messages to your bots, Wexio automatically:

1. Throttles — Silently skips processing for rapid-fire messages while still saving them to chat history
2. Warns — Sends a system message asking the user to slow down
3. Blocks — Temporarily or permanently blocks the user based on your organisation's settings

Message Deduplication

Wexio uses a unique "latest wins" deduplication system. When a user rapidly sends multiple identical messages (e.g., spamming /start), only the last message is processed — preventing duplicate flow executions and bot responses.

Outbound Spam Protection

The platform protects your end users from accidental message flooding caused by misconfigured flows or infinite loops:

Per-Chat Protection

• Loop detection — If a flow card is visited 5+ times in one execution, the flow is automatically cancelled
• Message flood cap — If a single flow execution sends 50+ messages, it's cancelled
• Rate limiting — If 30+ messages are sent to one chat within 40 seconds, outbound is paused for that chat

Organisation-Level Escalation

If 3 or more chats trigger outbound violations within 5 minutes, Wexio temporarily blocks all outbound messaging for the entire organisation for 5 minutes:

• All active flows are cancelled
• Inbound messages continue to arrive normally (no data loss)
• Operators can still view chats and read messages
• All online org members receive a real-time WebSocket notification
• Outbound automatically resumes after 5 minutes

Spam Protection Settings

Each organisation can configure their inbound spam protection behaviour:

API Rate Limits

Public API endpoints include rate limiting with standard response headers:

X-RateLimit-Limit: 200           # Max requests in current window
X-RateLimit-Remaining: 142       # Requests left in current window
X-RateLimit-Reset: 1710453795    # Unix timestamp when window resets

When rate limited, the API returns 429 Too Many Requests with a Retry-After header.

File Upload Security

All file uploads go through multiple security checks:

Data Retention & GDPR Compliance

Automatic Data Retention

Wexio implements configurable data retention policies that automatically clean up old messages based on your plan and settings. A daily cleanup job runs at 3:00 AM to delete messages older than the configured period. See Database Settings for retention configuration.

Retention Limits by Plan

Retention limits depend on your plan tier:

Retention Settings

Organisations on eligible plans can configure:

• Message retention period — How long messages are kept before automatic deletion
• Media retention — Whether to follow message retention or set a separate period
• Delete media with messages — Automatically remove associated media files when messages are deleted
• Preserve starred chats — Keep messages in starred chats regardless of retention policy

GDPR Compliance

Wexio is designed with privacy by design and implements key GDPR requirements:

Compliance & Certifications

Wexio is committed to maintaining compliance with applicable data protection regulations and industry standards.

• GDPR — Wexio processes personal data in accordance with (EU) 2016/679. We act as a Data Processor and maintain Data Processing Agreements (DPAs) with all customers covering Article 28 requirements.
• Infrastructure certifications — All services hosted in EU (Ireland). AWS maintains SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, and PCI DSS Level 1 certifications. MongoDB Atlas is SOC 2 Type II and ISO 27001 certified.
• PCI DSS — Payment processing is fully delegated to Stripe, a PCI DSS Level 1 certified provider. Wexio does not store, process, or transmit cardholder data.
• Vulnerability management — Continuous scanning with Dependabot and Snyk, critical patches within 24 hours, annual third-party penetration tests, and an active Bug Bounty programme.

Incident Response

Wexio maintains a formal Incident Response Plan following NIST SP 800-61 guidelines, with clear procedures for detecting, containing, investigating, and recovering from security incidents.

• Documented response plan covering identification, containment, eradication, recovery, and post-incident review phases with defined severity levels and escalation paths.
• Breach notification within 72 hours to affected customers and relevant supervisory authorities as required by GDPR Article 33, including the nature of the breach, affected data, and remediation steps.
• Cross-functional incident response team with defined roles, on-call rotations, and regular tabletop exercises.
• Blameless post-mortem analysis for every security incident — root causes identified, corrective actions tracked to completion, and lessons learned incorporated into security practices.

Security Layers Overview

Wexio's security is built in five layers, each providing defence in depth:

Compliance Status

Security Contact

If you have security concerns, wish to report a vulnerability, or need to request security documentation (including DPA or penetration test summaries), please contact our security team at security@wexio.io.