Security at Onevyu
A plain-language overview of how Onevyu protects customer and client data, for solopreneurs and anyone evaluating the product. Full legal detail lives in the Privacy Policy and Terms of Service.
Encryption
Data is encrypted in transit and at rest. Traffic to onevyu.com is served over HTTPS. Application and infrastructure layers are configured so sensitive credentials, including OAuth tokens, are stored securely.
Official Meta OAuth for WhatsApp, Instagram, and Facebook
Channel connections use official Meta APIs and OAuth, including Embedded Signup where applicable, for business assets only: WhatsApp Business, Instagram Business linked to a Facebook Page you administer, and Facebook Page Messenger. Personal WhatsApp numbers and profile-only Instagram accounts cannot connect.
You authorize only the permissions needed to operate Conversation CRM for your workspace. Onevyu does not sell your client conversations or Meta message content for third-party advertising. Channels can be disconnected anytime under Connections.
Security headers
- HTTPS / HSTS — Strict-Transport-Security with a long max-age, includeSubDomains, and preload.
- Content-Security-Policy — tuned for the app and required third parties (Supabase, Meta SDK, payment providers, analytics).
- X-Frame-Options: DENY and related framing protections.
- X-Content-Type-Options: nosniff.
- Referrer-Policy — strict-origin-when-cross-origin.
- Permissions-Policy — camera, microphone, and geolocation disabled by default.
- Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy defaults appropriate for checkout flows.
Access controls and data handling
Workspace data is scoped to your authenticated account. Onevyu applies commercially reasonable technical, administrative, and organizational measures — encryption, access controls, and regular security assessments — as described in the Privacy Policy. Export options exist so you are not locked in; account deletion and sign-out controls are in Settings.
Hosting and infrastructure
Onevyu is a web application. Production hosting uses Vercel for front-end and edge delivery and Supabase for backend data and auth. Meta provides the official messaging APIs when you connect those channels. Subscription payments are processed by Paddle or Razorpay depending on region. These providers appear in the Terms as subprocessors.
Data residency follows those providers' regions and configurations. Onevyu does not claim a dedicated on-premises data center under its exclusive control.
Compliance audits
Onevyu does not currently hold SOC 2, ISO 27001, or equivalent third-party audit certifications. Formal external audits are on the roadmap. This page will be updated when a certification is completed — Onevyu does not display SOC 2 or ISO badges it has not earned.
Reporting a security concern
Email support@onevyu.com with enough detail to reproduce and assess the report. Coordinated disclosure is appreciated.