Trust
Your data, in one place
Where your data is kept, who handles it and what we promise about it, gathered from our Security page, Privacy Policy and Terms. Each point links to the page it comes from.
Last updated 19 October 2026
Where data is
Where your data is kept
Fliok runs on servers in India. Some of the companies that help run it work elsewhere.
Held in India
The servers that hold Fliok and its database are in India.
On an encrypted disk, backed up encrypted
The database and the files stored in Fliok, such as media, are kept on an encrypted disk volume. The database is backed up every night to off-site storage, encrypted with AES-256 before it leaves our server.
Messages travel through Meta
WhatsApp messages are sent and received through Meta’s Cloud API, in Meta’s own data centres, which may be outside India. Chats through the Cloud API are not end-to-end encrypted.
Transfers outside India
Some of the providers listed in the Privacy Policy may process data outside India. We transfer personal data outside India only as Indian law allows, and only as far as each provider needs it for its job.
Security
How we protect it
The Security page sets out each measure, stated plainly. In short:
Encrypted on the way and on the disk
Fliok is served over HTTPS only, and your access tokens and keys are encrypted before they are stored.
Your workspace is yours alone
Every record carries the workspace it belongs to, and every request is checked against it.
Who can get in, and what they can do
No passwords, sign-in codes that expire, two-step verification, roles, restrictions for one person and an activity log. API keys are stored as hashes, and webhooks are signed.
Sub-processors
Who processes data for us
One list, kept in one place, so it cannot drift.
The list is in the Privacy Policy
Section 4 of the Privacy Policy lists every company that processes personal data for Fliok: what each does and where. We update it when one is added or replaced.
Payments
Card and bank details are entered with Razorpay and are not stored by us.
Your customers’ data
You decide, we process
Under India’s Digital Personal Data Protection Act, 2023, you are the data fiduciary for your customers’ data and we are your data processor.
Only on your instructions
We process it only to provide Fliok as you use and set it up, and as the law requires. We keep it confidential, and our staff get access only where they need it to run or support Fliok.
Told without delay
If a personal data breach affects it, we tell you without undue delay and help you meet your own duties.
Requests from your customers
You can edit or delete a contact at any time; deleting one erases their chats, messages and stored files. The workspace owner can download the workspace’s data from Settings.
Deleted when you leave
When you close your workspace, sending and receiving stop at once and the data is erased from Fliok 30 days later. Encrypted backups are deleted on their schedule: daily copies after 30 days, monthly copies after 12 months.
Meta
Your number stays yours
Fliok is a Meta Tech Provider for the WhatsApp Business Platform.
It lives with Meta, not with us
Your WhatsApp number and your WhatsApp Business Account belong to you and live with Meta, so you can leave Fliok and keep them.
Signed DPA
Need a signed data processing agreement?
Email us and ask for one. Include your company’s legal name and the name of your Fliok workspace.
The data-processing terms that apply today are in section 7 of the Terms. Your rights under India’s DPDP Act and our Grievance Officer are in the Privacy Policy. To report a security problem, see Security.