Security

Security is shared between Souhait Hub, our service providers, businesses using Souhait Connect, and their authorised users.

Souhait Hub is responsible for protecting the infrastructure and application components under its control.

Customers are responsible for:

• Protecting passwords and connected accounts;
• Restricting access to authorised users;
• Assigning appropriate user roles;
• Securing their devices and networks;
• Configuring automations safely;
• Protecting exported data;
• Removing former employees and contractors;
• Maintaining control of their Meta and WhatsApp accounts; and
• Promptly reporting suspected incidents.

Souhait Connect is designed to restrict access to information based on account membership, roles, and permissions.

Our security practices may include:

• User authentication;
• Role-based access controls;
• Administrative access restrictions;
• Separation of customer workspaces;
• Session-management controls;
• Access logging;
• Credential rotation; and
• Periodic review of privileged access.

Customers should provide each team member with a separate account and grant only the permissions required for that person’s work.

Souhait Connect uses encrypted HTTPS connections to protect supported information transmitted between users, the platform, and integrated services.

Where supported by our infrastructure providers and appropriate to the information involved, stored data, backups, and credentials are protected using encryption or comparable safeguards.

WhatsApp message delivery is also subject to Meta and WhatsApp’s infrastructure and security practices. Data processed through the WhatsApp Business Platform may pass through systems operated by Meta and authorised service providers.

Access tokens, API credentials, webhook secrets, and similar integration credentials are treated as sensitive information.

We use measures designed to:

• Restrict credential access;
• Prevent credentials from appearing unnecessarily in application interfaces;
• Validate webhook requests where supported;
• Separate development and production access;
• Rotate or revoke credentials when compromise is suspected; and
• Avoid storing complete payment-card credentials.

Customers must not expose access tokens in public repositories, screenshots, support messages, browser code, or shared documents.

Our development and operational practices may include:

• Dependency and vulnerability monitoring;
• Secure configuration management;
• Input validation;
• Authentication and authorisation checks;
• Protection against common web-application attacks;
• Logging and error monitoring;
• Backup and recovery procedures;
• Controlled software deployment;
• Security patching; and
• Review of material platform changes.

Security measures evolve as the platform, threats, and available technologies change.

Souhait Connect is a multi-tenant platform. We use logical access controls designed to prevent one customer from accessing another customer’s workspace or data.

Customers must not attempt to access another account, tenant, conversation, integration, or dataset. Any accidental cross-account access must be reported immediately and the information must not be retained, copied, or disclosed.

Subscription payments may be processed by Paystack or another authorised payment provider.

Souhait Connect does not ordinarily store complete payment-card numbers, card verification values, Mobile Money PINs, or online-banking credentials. Payment providers process payment credentials according to their own security and compliance obligations.

When AI functionality is enabled, selected information may be transmitted to authorised AI service providers to generate, classify, retrieve, or summarise content.

We seek to limit transmitted information to what is reasonably necessary for the requested function. Customers should avoid placing unnecessary sensitive information in prompts, knowledge bases, and automated workflows.

AI-generated responses should be reviewed where accuracy, privacy, safety, or legal compliance is important.

We may maintain operational and security logs to:

• Diagnose technical problems;
• Detect suspicious activity;
• Investigate incidents;
• Prevent fraud and abuse;
• Enforce access controls; and
• Maintain platform reliability.

Access to security logs is restricted according to operational need. Logs are retained only for reasonably necessary operational, legal, and security periods.

We may maintain backups designed to support restoration following data corruption, infrastructure failure, or another service incident.

Backups are not intended to replace a customer’s own record-retention obligations. Customers should export and securely retain information essential to their legal or business operations.

Deleted data may remain temporarily in protected backups until those backups are overwritten under normal retention schedules.

Souhait Connect relies on selected providers for services such as:

• Cloud hosting;
• Databases and storage;
• Authentication;
• WhatsApp connectivity;
• Artificial intelligence;
• Payment processing;
• Email delivery;
• Analytics; and
• Error and performance monitoring.

We consider the security role of service providers before using them for material processing and seek appropriate contractual and technical protections.

We maintain processes designed to identify, assess, contain, investigate, and remediate suspected security incidents.

Where a confirmed incident affects personal data, we will notify affected customers, individuals, regulators, or other parties when required by applicable law or contract.

Notices may include the nature of the incident, information involved, actions taken, potential risks, and recommended protective steps, where such information is available and may lawfully be disclosed.

If you believe you have discovered a vulnerability, please report it privately and promptly.

Send reports to:

Preferred email

security@souhaitconnect.com

Alternative email

support@souhaithub.com

Include:

• A description of the vulnerability;
• The affected page, endpoint, or feature;
• Steps required to reproduce it;
• The potential impact; and
• Supporting screenshots or technical details.

Please do not:

• Access, alter, copy, or delete data belonging to another person;
• Disrupt or degrade the Services;
• Use automated testing that creates excessive traffic;
• Install malware;
• Conduct denial-of-service testing;
• Publicly disclose an unresolved vulnerability; or
• Use a vulnerability to demand payment or threaten Souhait Hub.

We will review good-faith reports and may contact the reporter for further information. Souhait Hub does not currently promise a monetary bounty unless agreed in writing.

If you suspect that your account, WhatsApp integration, access token, or device has been compromised:

1. 1Change your password immediately.
2. 2Revoke unauthorised sessions and integrations.
3. 3Remove unknown team members.
4. 4Secure the connected Meta and WhatsApp accounts.
5. 5Contact us at support@souhaithub.com.
6. 6Preserve relevant dates, screenshots, and logs.

Do not send passwords, authentication codes, payment PINs, or complete card information to our support team.

While we take reasonable precautions, we cannot guarantee that:

• The Services will never be interrupted;
• Every vulnerability will be prevented;
• Third-party systems will remain available;
• Messages will always be delivered;
• Data will never be lost; or
• An account will remain secure where credentials or devices are compromised.

Customers should maintain appropriate internal controls, business-continuity plans, and independent copies of essential records.

Security questions and incident reports may be directed to the Souhait Hub Security Team: