Security & Privacy

Your data stays private to you. It's never sold, never shared with advertisers, and never used to train external AI models.

Encryption

All data is encrypted both at rest and in transit, on every plan, and WhatsApp messages are encrypted by default through the WhatsApp Business API. Documents in the AI Knowledge Base use AES-256 at rest and TLS 1.3 in transit.

You can control who on your team can view, edit, or search sensitive information through role-based access. Audit logs are included from the Growth plan upward.

Data protection

HabariChat is registered with Kenya's Office of the Data Protection Commissioner as both a data controller and a data processor under the Data Protection Act 2019. Conversations are encrypted, access is role-restricted to your authorised team, and customers can request access to or deletion of their communication records.

HabariChat routes and manages messages rather than storing sensitive records like financial transactions, medical records, or student academic files. Data is never sold, shared with third parties, or used to train outside AI models.

For formal data processing agreements or compliance reviews, contact the team directly. See also the Privacy Policy and Terms of Service.

ODPC registrations

HabariChat is operated by Habari Labs Limited, a Kenyan private limited company. The company is entered on the Office of the Data Protection Commissioner (ODPC) register in both capacities the Data Protection Act 2019 recognises, so whichever role applies to your data, the registration is in place.

Registration	Certificate serial	Valid
Data Controller	24634	28 Jul 2026 to 28 Jul 2028
Data Processor	24633	28 Jul 2026 to 28 Jul 2028

Both certificates share one ODPC Registration Identification: 291-998E-831F. The registered entity is Habari Labs Limited, company number PVT-BB1PA5W3, Nairobi, Kenya.

For your own records: you are the data controller for the messages and contacts your customers send you, and Habari Labs Limited is your data processor for that data. We are a data controller only for the data we need to run the business, such as your account, billing, and support records. Our Terms of Service sets this split out in full.

Doing a vendor security review? Email [email protected] for copies of both certificates and our standard Data Processing Agreement.

SSO & data residency

Data residency and single sign-on through SSO/SAML are included on the Enterprise plan, alongside a dedicated account manager. Encryption is on every plan, and audit logs come in from the Growth plan upward.