WeHub
מעבר לעבריתSign inStart a trial

Security and privacy

One business never sees another business data, and an agent never sees past the scope their permissions grant. This is covered by automated tests, not only by a claim.

Tenant isolation

Isolation is implemented in the data layer, not in the view layer.

  • Every business table carries a tenant id, first in every index and unique key.
  • Access goes through a wrapper that injects the tenant id into every read and write.
  • An automated lint fails if a business module touches the database directly.
  • Every lookup by id passes through that wrapper, so reaching another business resource returns 404.

Encryption and secrets

Channel secrets are never stored as text, and cannot be moved between businesses.

  • AES-256-GCM, with additional authenticated data built from the tenant id and the field name.
  • A key version in every blob header, so keys can rotate without downtime.
  • Secrets are displayed masked. A webhook token is shown exactly once.
  • Media sits in private storage and is served only through a URL signed for fifteen minutes.

Identity and permissions

One identity per person, and a separate membership in each business.

  • Two-factor authentication with TOTP or SMS, plus recovery codes.
  • A business can require two-factor authentication for its entire team.
  • Four roles with per-agent key overrides.
  • IP allowlisting and single sign-on, on the plans that carry them.

Audit and transparency

A sensitive action leaves a row, including when WeHub staff perform it.

  • An audit log for sign-ins, role changes, channel connections, exports and plan changes.
  • A WeHub support session is time-limited, shown in a prominent banner and recorded.
  • Support sessions are read-only by default. Writing requires the business owner approval.
  • Logs mask tokens, secrets and full phone numbers, and never carry message bodies.

Regulatory readiness

Legal documents are edited from the console and published as versions, in Hebrew and English.

  • Terms of service, privacy policy, cookie policy and a data processing agreement.
  • An accessibility statement per the Israeli 2013 regulations and IS 5568 at level AA.
  • A data deletion endpoint, as Meta requires.
  • A full export of the business data at any point, recorded in the audit log.

Connect your first channel today

The wizard creates the business, connects a channel and invites the team. It ends by having you message yourself and watch it land.

Start a trialTalk to us