Security practices

This is an operator checklist, not a replacement for the control inventory. Review Security at Fluenta for the implemented safeguards and current gaps, and use Data deletion for the complete deletion and retention paths.

1. 1Viewer is read-only access to bots and logs. Use it for people who only need to inspect activity.
2. 2Agent handles support tickets in the Inbox but cannot edit bots or workspace settings. Use it for day-to-day support operators.
3. 3Editor can build and publish bots. Use it for people who need to change flow behavior without taking workspace-administration responsibility.
4. 4Owner has full access, including workspace management. Keep this role limited to people who are responsible for members, credentials, and billing decisions.

1. 1If a WhatsApp access token may have leaked, revoke it in the Meta app that owns it and create a replacement. Then open the bot settings, update the access token under Meta credentials, save it, and re-check the Meta connection.
2. 2Keep the app secret in Fluenta matched to the same Meta app that is configured to send the webhook. If the Meta app changes, update the matching app secret before relying on inbound webhook verification.
3. 3Do not paste access tokens, app secrets, connector credentials, or other secret values into support requests. Share the non-sensitive error, affected bot, and steps to reproduce instead.

1. 1There is no two-factor authentication. Treat role assignment and credential rotation as important compensating operating practices.
2. 2There is no self-service data export. Use the data-deletion contact path when an export is needed.
3. 3Fluenta has no certification or audit such as SOC 2, ISO 27001, HIPAA, or PCI. Do not represent one to customers or procurement teams.

A scheduled job purges expired conversation data after 90 days. It also anonymises retained orders by removing the phone number, customer text, Meta message ID, and conversation ID, and deletes audit events for revealed identities. See Data deletion for the operator procedure and field-level details.

A teammate needs to inspect activity but does not need to change a bot.

Assign Viewer rather than a higher role. If the person only works support tickets, assign Agent instead of Editor or Owner.

A WhatsApp access token may have been exposed.

Rotate it in the owning Meta app, replace the stored token in Fluenta, save the credentials, and re-check the connection. Do not send the exposed token to support.

Inbound webhook verification fails after the Meta app changed.

Confirm that the stored app secret belongs to the same Meta app configured for the webhook, then update the credentials and verify the connection again.

A customer asks for two-factor authentication, a self-service export, or a certification.

State the current gap plainly. These controls are not available today; use the Security and Data deletion pages to explain the implemented controls and request paths.