WhatsApp Business, on your own infrastructure.

Yes. Each tenant supplies its own Meta App credentials. Every message and every media blob is stored on the tenant’s own IIS filesystem under App_Data. No CodeB-side relay, no third-party BSP in the middle. If you delete the tenant directory, every WhatsApp conversation with that tenant is gone.

They’re Business Solution Providers — they hold the Meta relationship and see every message before forwarding it. Our connector is a direct-to-Meta bridge: you register your own Meta App, hold your own Access Token, and Meta posts webhooks straight to your server. Fewer parties, lower latency, no per-message BSP fee.

Meta lets app owners require an HMAC-SHA256 proof (App Secret over the Access Token) on every server-to-server Graph API call. Even if an Access Token leaks, calls without the proof are rejected. Our connector always computes and sends the proof, so you can enable Meta’s “Require app secret” toggle any time without breaking anything.

Inbound message with an image / audio / video / document / sticker: the connector fetches Meta’s media metadata, downloads the binary from the lookaside URL, and caches both under App_Data/<tenant>/chat-whatsapp/media/<mediaId>. Chat clients render inline via /whatsapp.ashx?action=media&id=<mediaId>, admin-gated. Nothing leaves your infrastructure after the initial Meta fetch.

Every inbound message is written to chat/groups/wa-inbox/messages/wa-<msg-id>.json. Meta message IDs are globally unique. On retry the file already exists and the ingestion loop logs [WA-DEDUP] skip-duplicate instead of double-posting.

Outbound send works pre-publish as long as the recipient is on Meta’s allowed-tester list. Inbound, however, requires the Meta App to be Published (which needs Business Verification). While unpublished, Meta only delivers synthetic events fired from the Meta Dashboard’s Send test webhook button.

The connector is included at zero cost with CodeB Sovereign Communications. You pay Meta directly for WhatsApp conversations (see Meta’s WhatsApp Business Pricing page). No per-message CodeB fee, no BSP markup.

Only messages is required — that covers both inbound messages AND delivery / read / failed status callbacks for outbound messages. Recommended additional subscriptions: message_template_status_update (drives the WebSocket toasts to chat.html), phone_number_quality_update, account_alerts. Full field list with per-field handling is on the admin page.

Not with free‑form text — Meta blocks that outside the 24‑hour customer service window. Two options are supported. (1) Send a Meta‑approved message template (utility, authentication or marketing category, reviewed by Meta) — a successful template send reopens the window for 24 hours. The compose bar in chat.html auto‑swaps to the template picker when the header pill goes amber, so the operator is never surprised. (2) Publish a wa.me/<E.164> click‑to‑chat link and let the customer message you first — a customer‑initiated inbound opens a fresh window with no template required.

Two mitigations. First, keys are mint‑once — the plaintext value is shown once at generation, then masked forever — and compared in constant time, with a uniform 401 on any auth failure. Second, an API key can be template‑bound: pinned to exactly one approved template and one language. A leaked bound key can send only that Meta‑reviewed template — free‑form is refused with 403 template-required, other templates with 403 template-mismatch, wrong language with 403 template-language-mismatch. Blast radius from a leak is at most one reviewed template until the key is revoked from /whatsapp-admin.html. The per‑day new‑chat quota caps how many distinct recipients a leaked key can reach in a day even before revocation.

No. This connector talks straight to Meta’s WhatsApp Business Cloud API — you register your own Meta App, hold your own Access Token, and Meta posts webhooks directly to your IIS server. No BSP is in the middle, no per‑message BSP fee is charged, and no third party sees your messages before you do. A BSP is still the right tool if you specifically want a managed template gallery, hosted number provisioning, or phone‑tree flow builders — things Meta’s own Dashboard doesn’t ship. Everything else, including message templates, media, delivery receipts and the 24‑hour customer service window, works directly against Meta with no intermediary.

Up to 3 {{n}} placeholders per template body. The cap is enforced on BOTH template creation (rejected with 400 too-many-placeholders when the body has more than 3) AND at send‑time (rejected with 400 too-many-parameters when the outbound components’ body parameters array exceeds 3). Placeholders must also be sequential starting at {{1}} — a body with {{1}} and {{3}} but no {{2}} is rejected with 400 placeholder-gap on creation. Meta itself accepts up to about ten placeholders in a body, but templates with more than a handful get flagged as poor quality and hurt your WABA sender quality rating; 3 covers the common hospitality patterns (name, date, code / name, property, check‑in / etc.) without inviting quality‑rating drag. Both templates-list and templates-list-external report the cap as a top‑level maxPlaceholders field and each template’s own placeholders: {count, indices, bodyText, exampleValues} object, so integrations know exactly how many parameters to send without re‑parsing the body text.

Aloaha Limited in Malta. Same team that builds the rest of CodeB Sovereign Communications.