Security
Security you can build a business on.
Lynkist handles your customers’ conversations — so protecting that data is foundational, not an afterthought. Here is exactly how we keep your workspace, your customers, and your business safe.
Tenant isolation by design
Every workspace gets its own isolated database schema. Your contacts, conversations, templates, and campaigns are never co-mingled with another customer’s data — isolation is enforced at the data layer, not just in application code.
Encryption in transit
All traffic to Lynkist — the dashboard, the public API, and webhooks — is served exclusively over TLS (HTTPS). Credentials and access tokens are never transmitted in clear text.
Scoped API keys
API access uses keys you create and revoke yourself. Keys are shown once at creation, stored as one-way hashes, and can be rotated at any time without downtime. Webhook payloads are signed so you can verify they came from Lynkist.
Role-based access
Invite teammates with the least privilege they need. Roles control who can send campaigns, manage billing, edit templates, or administer the workspace — so day-to-day agents never touch sensitive settings.
Official WhatsApp Business API
Lynkist connects through Meta’s official WhatsApp Business Platform. Messages flow through Meta’s end-to-end encrypted infrastructure — we never use unofficial or grey-route gateways that put your number at risk.
Payments stay with the processor
Card and payment details are handled directly by our PCI-DSS compliant payment partners. Lynkist never stores raw card numbers — we only keep the tokens and metadata needed to manage your subscription.
Audit logging
Sensitive actions — logins, key creation, member changes, and billing events — are recorded with actor, timestamp, and context, so you can reconstruct who did what and when.
Reliable, monitored infrastructure
Lynkist runs on hardened cloud infrastructure with network isolation, automated backups, and continuous monitoring. Live uptime and incidents are published on our status page.
Data ownership & control
Your data is yours. You can export your contacts and conversation history, and you can delete your workspace at any time. When you delete an account, we remove your workspace data on the schedule described in our Privacy Policy, subject to any legal retention we are required to honour.
Where we are on certifications
We are transparent about our posture. Lynkist already enforces tenant isolation, encryption in transit, scoped credentials, and audit logging. We are actively investing toward formal certification (including SOC 2) as we grow. If you need a vendor security questionnaire or DPA completed today, our team is happy to work through it with you directly.
Responsible disclosure
Found a vulnerability? We want to hear about it. Report it privately to security@lynkist.io and give us a reasonable window to investigate and fix before any public disclosure. We will not pursue action against good-faith researchers who follow this process.