How Lazga protects your business.

Each business sees only its own data

• Every account is tied to one business. The dashboard and its API take that business from your signed-in session on our servers, never from the address bar or anything the browser sends.
• That link between an account and a business can only be set by Lazga’s servers. A user cannot change it.
• Records are looked up inside your business only. Ask for another business’s booking, order or file and the answer is “not found”.

Where your data lives

• Your data is stored in a Postgres database hosted by Supabase in Mumbai, India. The servers that run lazga.ai are in the same region.
• The Studio, which designs and publishes your content, runs in Frankfurt, Germany. Photos and videos are stored with Cloudinary.

Encryption and secrets

• All traffic to lazga.ai, and every call Lazga makes to WhatsApp, Instagram, the payment gateway and its other providers, goes over HTTPS.
• Your WhatsApp Business connection token, your own card gateway keys and your ad account tokens are encrypted with AES-256-GCM before they are stored. Ad account tokens are also bound to their own record, so a copied token will not open anywhere else.
• Database keys, API keys and signing secrets live only on our servers. None of them is ever sent to your browser.

Payments

• Card details are typed into the bank’s own payment form (CyberSource, through Bank al Etihad). The card number goes from the customer straight to the gateway. Lazga never receives or stores it.
• A payment is marked paid only after Lazga checks the gateway’s own signed result, or finds the transaction on the gateway itself. The browser’s word is never enough.
• When customers pay by CliQ, the money goes straight to the business’s own account.

Every incoming message is verified

• Messages from WhatsApp, Instagram and Messenger are accepted only when Meta’s signature on them checks out. Anything unsigned or altered is rejected, and if the check cannot run, nothing is processed.
• The same goes for Shopify, Cal.com and GitHub, each checked against its own signature. Foodics sends to a private address unique to each business.
• Scheduled jobs only run with a secret key, compared in constant time.

Who can do what

• Sign-in is handled by Supabase Auth. Lazga never stores your password itself.
• Lazga’s own staff console is a separate sign-in, open only to accounts given a staff role on our servers. A business account cannot reach it.
• Only the business owner’s login can change what an ad account spends, approve an ad or accept the ad terms. Lazga staff can stop ads, but never decide for the owner.

A record of changes

• When Lazga staff act on a business account from our console, the action is logged: who did it, what they did and on which account.
• Your brand’s voice and visual rules change through one path only, and every change is recorded with who made it and why.

WhatsApp and Meta rules

• A WhatsApp template with any empty field is refused before it reaches WhatsApp. Customers never receive a half-filled message.
• Before writing to a customer, Lazga checks WhatsApp’s 24-hour customer service window and uses an approved template when it has closed.

Deleting your data

• You can ask us to delete your business’s data, or a customer can ask to have their messages deleted. How it works and how long it takes are on our Data Deletion page.

Data Deletion page →