SECURITY & DATA
Where your data lives, who sees it, how it is protected.
Last updated: 23 September 2026 · This is not marketing copy; it describes our infrastructure as it stands today and is updated whenever it changes.
1. Infrastructure and data location
Badex Chat (wa.badex.net) and its mobile app run in a data centre in Frankfurt, Germany, inside the European Union. Our website, DNS and corporate e-mail are hosted on our servers in Istanbul. All traffic is encrypted with TLS, certificates renew automatically and HSTS is enforced; unencrypted connections are not accepted.
2. WhatsApp connection
Your number is connected through the official Meta WhatsApp Cloud API using Meta's Embedded Signup flow. The number and the WhatsApp Business account stay in your own Meta Business account; you can revoke Badex's access there at any time. There is no phone emulator, third-party gateway or unofficial bridge in between, so the number-ban risk that comes with unofficial tools does not exist here. Badex is a Meta Business Partner (verify).
3. AI and your data
Assistant replies are generated through OpenAI's business API; data sent through the API is not used to train models under OpenAI's enterprise data policy. The knowledge base you upload (products, prices, FAQs, documents) is bound to your account only; no other customer's assistant can reach it. The system is multi-tenant and every query is scoped by company ID.
4. Access and authentication
- Panel login is verified in a second step with a one-time code sent to your WhatsApp after e-mail and password; trusted devices are remembered for a limited time.
- Permissions are role-based: the account owner sees billing and settings, staff see only the inbox and contacts opened to them.
- Passwords are stored as irreversible hashes; session cookies are encrypted and sent over HTTPS only.
- The Badex team accesses your account only on your support request and only within its scope.
5. Backups and continuity
The database is backed up twice a day and the whole server once a day. Backups are kept in geographically separate storage, independent of the application server; database backups are retained for 30 days, full-system backups for 7 days.
6. Payment details
Your card details never touch Badex servers. The payment form is served directly by iyzico, a PCI-DSS certified payment institution; Badex only sees the last four digits and the transaction result.
7. Privacy and your rights
The data controller is Badex Yazılım ve Dijital Hizmetler Limited Şirketi (Gaziantep, Türkiye). Your customers' messages and contact details are processed on your behalf; they are never used for advertising, sold or rented to third parties. When you close your account, your data is deleted from the system and disappears completely once the backup retention period ends. For your rights under Turkish data-protection law (KVKK) and the GDPR (access, rectification, erasure, objection) write to bilgi@badex.net; we reply within 30 days at the latest.
Related documents: KVKK Notice · Privacy Policy · Cookie Policy · Terms of Use
8. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Meta Platforms | WhatsApp, Instagram and Messenger APIs | EU / USA |
| Hostinger | Badex Chat hosting | Frankfurt, Germany |
| OpenAI | AI reply generation (API) | USA |
| iyzico | Payment processing | Türkiye |
| Backup storage, site analytics | EU / USA | |
| Güzel Hosting | badex.net web, DNS and e-mail | Istanbul, Türkiye |
9. Verify our partner badges
Don't take our word for the badges on this site; check the source:
- Meta Business Partner — search for "Badex" in the Meta Business Partner Directory.
- Google Partner — search for "Badex" in the Google Partners Directory.
10. Reporting a vulnerability
If you find a security issue, write to bilgi@badex.net. We respond within 72 hours and do not take legal action against good-faith researchers.