This documentation page is live-rendered from the AI WCRM Knowledge Engine.
# AES-256 Vault Encryption, SOC-2 & Compliance Guide
AI WCRM is engineered from the ground up to meet strict enterprise security standards, data privacy regulations (Digital Personal Data Protection Act - DPDP India & GDPR), and SOC-2 audit requirements.
---
### Data Encryption Standards
<Callout type="tip">
**Encryption at Rest & in Transit**: All customer data, WhatsApp message logs, and BYOK credentials are protected with industry-standard encryption protocols.
</Callout>
- **Encryption at Rest**: Customer data and database tables are encrypted using **AES-256-GCM**.
- **BYOK Vault Encryption**: Secret API keys (OpenAI, Gemini, ElevenLabs, Retell) are encrypted with unique per-account salt keys using `aes-256-cbc` / `gcm` before writing to storage.
- **Encryption in Transit**: All API traffic, webhooks, and dashboard connections enforce **TLS 1.3** encryption with HSTS.
---
### DPDP Act (India) & GDPR Compliance
AI WCRM helps enterprises maintain full legal compliance with privacy laws:
1. **Consent Tracking**: Every WhatsApp contact record stores explicit opt-in source and timestamp.
2. **Right to be Forgotten**: One-click PII sanitization — permanently purge a customer's phone number, name, and message history upon request.
3. **Automated PII Masking**: Mask sensitive personal identifiers (Aadhaar, credit cards, passwords) before sending prompts to external LLMs.
4. **Data Residency**: Data hosting available in Indian AWS/GCP regions (Mumbai / Hyderabad) for government & BFSI compliance.
---
### SOC-2 Type II Audit Logging
Every critical system event generates an immutable, tamper-evident audit record stored in the SOC-2 audit trail.
#### Logged Audit Events:
- User login / logout & 2FA verification attempts.
- Role changes & PBAC permission modifications.
- BYOK API key additions, edits, or rotations.
- Contact CSV exports and bulk broadcast dispatches.
- System error events & auto-failover triggers.
```ts
// SOC-2 Audit Event Format
export interface AuditLogEntry {
id: string;
timestamp: string; // ISO 8601 UTC
actor_id: string; // User ID or API Token ID
actor_ip: string; // Origin IP address
event_type: string; // e.g. "byok_key_updated"
resource_type: string; // e.g. "ai_provider_config"
resource_id: string;
changes: {
before?: Record<string, unknown>;
after?: Record<string, unknown>;
};
status: 'success' | 'failure';
}
```
---
<Callout type="info">
**Vulnerability Management**: AI WCRM undergoes automated daily static security scans (SAST) and bi-annual independent third-party penetration testing.
</Callout>