W
Loading
Loading
Security
How Wrati protects accounts, conversations and payments. This page describes the controls in place at a level intended to inform without providing a map for anyone trying to get around them.
All traffic between apps and Wrati is served over HTTPS/TLS. Cross-origin access is restricted to an explicit allow-list rather than left open.
Passwords are stored only as salted bcrypt hashes. Wrati cannot read your password, and a database copy would not reveal it.
Access is granted by signed tokens with a limited lifetime. Real-time connections are authenticated at handshake, and a token belonging to a deleted or deactivated account is refused rather than merely expiring.
One-time codes are stored hashed, never in plain text. They expire, are consumed on first successful use so they cannot be replayed, and are subject to attempt limits and send throttling.
Paid features and privileged actions are enforced on the server. A modified app, a direct API call or a hand-crafted real-time event is checked the same way a normal request is — the client is never the authority on what a person is allowed to do.
Media shared in conversations is not publicly addressable. Access requires a signed link that expires, is bound to the person it was issued to, and cannot be edited to point at a different file. Requests are authorised against conversation membership before a link is issued.
Payment outcomes are never accepted from the browser. Provider callbacks are signature-verified, payment events are processed exactly once even when delivered repeatedly, and unresolved payments are reconciled directly against the provider.
Uploaded images and message text pass through automated screening before delivery. See Responsible AI for how those systems are supervised.
Administrative capability is role-based, and sensitive actions are recorded in an audit trail.
Credentials and signing keys are supplied through environment configuration, never committed to source control and never sent to client applications. Payment provider credentials are stored encrypted.
No platform is completely secure, and any service that tells you otherwise is selling something. Wrati does not claim to be unbreachable, fraud-proof or certified. The following are known and openly stated:
If you believe you have found a security issue, please contact us through the contact page with enough detail to reproduce it, and give us a reasonable opportunity to investigate before disclosing it publicly. We will not pursue action against good-faith research that respects other people's privacy and avoids degrading the service.