Security

Security and limits

How the connection works, what the server controls and what stays with you.

Like a linked device

Felku joins WhatsApp the same way WhatsApp Web does: as a device linked to your number, outside the official API. As with any connection of this kind, WhatsApp may limit numbers with unusual activity, and nobody can guarantee otherwise.

What the server controls

• A minimum gap between sends and hourly and daily caps that grow with the age of the connection.
• Sending hours.
• Every send goes through the server limits (pacing, caps and sending hours). The preview is available whenever the agent asks for it.
• Only chats on the allowlist; groups, status and Channels are off by default.

Where the chat text goes

Your agent only reads the chats on the allowlist. The text of those chats is sent to the AI service your agent uses, under that service’s rules; Felku does not control that. You can disconnect at any time, and disconnecting deletes the session.

What we keep, how we protect it and when we delete it

Your WhatsApp session and your Telegram bot token are stored encrypted (AES-⁠256), with a key specific to your account, kept outside the database. For your agent's access keys, we keep only a fingerprint (hash), never the key itself. Between your agent or browser and our server, everything goes over an encrypted connection (HTTPS).

Stored messages don't have that layer yet: they stay on the server, with restricted access, until we delete them on the schedule described below. No one on our team has a tool to read them.

We keep received messages for 24 hours (trial and Personal), 7 days (Pro) or 30 days (Business), and only what arrived after you connected. After that, they're deleted automatically, within 10 minutes. Received files aren't stored: they go straight to your agent. The activity log doesn't keep message text.

Dis­con­nect­ing a number or bot immediately deletes that connection's session (or token) and stored messages. Deleting your account immediately deletes the account, connections, keys and messages. Backups, when active, are gone within 8 days. Access logs (date, time and IP, no content) are kept for 6 months because the law requires it.

This isn't end-to-end encryption. For your agent to work around the clock, messages pass through our server when they arrive and when they're sent.

Good practices

• Disconnect this number from other systems that use it as a linked device (other APIs, dashboards or bots). Two systems on the same number at the same time can disconnect each other.
• In Linked devices, check how many devices the number already has. WhatsApp allows up to 4 linked devices; remove the ones you no longer use.
• Open WhatsApp on the main phone at least every 14 days, or the linked devices disconnect.
• Start with few messages and only with people who already talk to you.

When you disconnect

The server ends the session in WhatsApp and deletes the encrypted session, the stored messages and the limits state. To come back you need to pair again.