Security

Polymorfa separates human Console sessions, server credentials, project credentials, and end-user client tokens. Each surface re-authorizes against live team and project state.

​

Hosting and messaging regions

Your Console accounts, settings and secrets are hosted in the EU, in Germany with backups in Finland. WhatsApp sessions and message processing run in Polymorfa’s Brazil or EU messaging region, according to the number’s assigned region. Messages also pass through the network edge and WhatsApp’s own servers; the regional boundary describes Polymorfa’s session storage and processing. Polymorfa’s Data Processing Addendum defines its GDPR processing obligations and agreed storage locations. The ANPD recognizes the EU as adequate for LGPD international transfers under Resolution 32/2026. That decision covers the transfer mechanism; your other LGPD obligations still apply.

​

Account authentication

The Console supports passwordless email OTP, passkeys, TOTP with recovery, configured social providers, session and device management, and the desktop device-authorization flow. The sign-in page shows only authentication methods enabled for Polymorfa. Under Account settings, add and verify additional email addresses, select a primary sign-in address, or remove a non-primary address. Under Authentication, use the Sign-in methods card to manage email access, passkeys, and each available social connection. Connected providers appear in the main list with controls to manage or unlink them; additional configured providers appear under More sign-in methods. Use the Two-factor authentication card to manage passkeys and an authenticator app with recovery codes. To enable an authenticator, scan the QR code and enter the current six-digit code from your app. Save the recovery codes shown after verification; each code works once if you lose access to the authenticator. Each active-session entry shows its IP address, estimated location, and last active time when that information is available. You can revoke one session or log out every other session while keeping the device you are using signed in. If an email address is already linked to an account, the Console identifies it as unavailable before sending a verification code. The same page also lists browser, Inspector, and command-line sessions. Social sign-in and social account creation are separate actions. Signing in with a provider does not create an account implicitly; use the sign-up page when you intend to create one. Inspector authorization confirms the signed-in account and team before the code is entered. The final review shows the requesting app, request time, available city and IP information, selected team, and active projects. Approve only when those details match the Inspector request. Dashboard access tokens are distinct from credentials intended for customer integrations. Never copy a dashboard token into an integration.

​

Notification delivery

Open a team, then select Team settings > My Notifications to manage your personal delivery choices for that team. Select one verified address as the team’s default notification inbox, or turn email delivery off. Add a project route when one project needs to use another verified address; the project route takes precedence over the team’s default. Each team keeps its own notification types, default inbox, and project routes. In-app notifications are always enabled and have no setting to disable them. Email changes save automatically. Removing an address, team, or project also removes routes that can no longer be used. New sign-in alerts are an account setting: turning them off on one team’s My Notifications page turns them off for your whole account. Security alerts have no unsubscribe link. See Personal notification settings for every notification type and for unsubscribe links in optional emails. Sign-in code requests send a generic email with the code, purpose, and expiry. They contain no IP address, location, account details, or account-management buttons. Anyone can request a code; receiving one does not mean someone signed in. New sign-in alerts, authenticated requests to add an email address, team invitations, team deletion confirmations, and API-key security alerts show the application or event source, reported client, IP address, approximate location, and time. A field reads Unavailable when Polymorfa cannot establish it. Location describes the network connection; a VPN or proxy can change it. Use Account settings or Manage sessions inside the details card to review authentication settings and revoke unfamiliar sessions. An exposed-key alert identifies the external report; it does not identify the person who exposed the key.

​

Integration credentials

Each credential kind has a distinct prefix and permissions. Client-token access is constrained by rules such as allowedActions, recipient policy, origins, per-minute rate limits, daily maximums, and enabled state. See Authentication for the complete boundary and scope list. The MCP endpoint accepts the same credentials. Project tokens require the mcp scope; client tokens require the mcp allowed action. Every tool then passes through the ordinary Messaging API authorization checks.

​

Webhook integrity

Native webhook deliveries include timestamped HMAC signature headers; Meta-compatible deliveries use Meta-compatible signature headers. Verify against the raw request body before parsing it, reject stale timestamps, and compare signatures in constant time. See Webhooks for the exact headers and algorithms.

​

Operational controls

• Keep team keys and project tokens on trusted servers.
• Grant the smallest scope set required by a workload.
• Prefer project tokens when an integration belongs to one project.
• Use client tokens for browser/mobile flows and set narrow actions, origins, recipients, and limits.
• Revoke or rotate a credential immediately when exposure is suspected.
• Use Audit Logs to inspect actors, actions, resources, results, source, IP, and changed fields.

For security disclosures or current compliance material, use polymorfa.com/security or email security@polymorfa.com.

​

Where to go next