Your contact base protected by design
Per-project isolation, media in a private bucket behind pre-signed URLs, automatic opt-out, an auditable consent trail, HMAC-signed webhooks and encrypted secrets.
Your contacts are your most valuable asset
A poorly kept contact base is expensive. That’s why protecting your base isn’t an extra — it’s how bZapper is built, from project isolation to the consent ledger.
We treat them as if they were ours: protected, isolated and under your control.
- Project isolation
Numbers, inbox, keys and suppression live in isolated projects. A key only sees its own project — nothing leaks between customers or environments.
- Private media with presign
Conversation files sit in a private bucket and only open via a short-lived pre-signed URL (24h by default). Nothing indexable, nothing loose.
- Native opt-out & suppression
Whoever replies STOP/SAIR/PARAR is suppressed automatically and never receives another send. The block list stops the send before queuing.
- Consent ledger
Every opt-in and opt-out lands in an append-only, timestamped and auditable ledger — the proof of legal basis the LGPD requires.
- Signed webhooks
Every event ships with an HMAC-SHA256 signature and timing-safe verification. The webhook secret is encrypted at rest.
- Encrypted secrets
WhatsApp sessions encrypted at rest and the OTP code never persisted nor displayed. Phone and email normalized in the database.
Contact suppressed in the project instantly and recorded in the consent ledger. Keyword opt-out also emits the contact.opted_out webhook.
bZapper is the data processor and handles the heavy privacy lifting; the legal basis for consent is your responsibility. We work together.
Read the Privacy & LGPD guide →Start sending over WhatsApp in minutes
Create your free account, generate an API key and make your first send today. No card, no red tape.