Security and data
Know exactly how your data moves.
Buza is designed around limited access, clear permissions and a record of every request. Here is what happens, in plain English.
What happens when someone asks a question
- 1
Message arrives
The question reaches Buza through WhatsApp and its messaging provider.
- 2
Identity is checked
Unknown numbers stop here. Sensitive questions can require a PIN.
- 3
AI picks an approved action
It chooses from a fixed list and never receives passwords or API keys.
- 4
Access is enforced
Buza checks permissions, then runs a read-only query in your system.
- 5
The reply is sent
The fetched result is written as a short message and logged as a request.
What is stored, and where
| Where | What is kept | Why |
|---|---|---|
| Buza | Approved users, roles and permissions | To control access |
| Secure vault | Encrypted connection keys | To connect to your systems |
| Audit log | Who asked what and when, retained for 12 months, or as agreed with you | To investigate issues |
| Short-term memory | Recent messages for 30 minutes | To understand follow-up questions |
| WhatsApp, messaging provider and phones | The messages themselves, under their own terms and settings | Message delivery and chat history |
We don't keep a separate copy of your full business database. Answers are fetched live, but the reply can remain in the WhatsApp chat. That is why sensitive information needs careful rules.
Controls you can ask us about
Read-only connections
The first version looks records up and doesn't change them.
Immediate removal
Remove a number and that person's access ends.
Written agreements
Data terms are agreed before any live connection.
Named providers
Current providers: Anthropic (AI), Meta (WhatsApp Cloud API), Render (hosting).
Have a security review to complete?
Send us your questionnaire and we'll answer it directly.