How we protect your customers' data
2way processes phone numbers, marketing consents and campaign results on behalf of our customers. This page summarizes the controls in place. Policies, sub-processors, certifications and documents are in our Trust Center.
The answers a security review asks for first
Where the data lives, how it is protected, and what happens to it when something goes wrong or the contract ends.
Data stored in the EU
AWS in Frankfurt and Dublin by default. A US region on request.
Encrypted at rest
TLS in transit. Databases, object storage and backups all encrypted.
Breach notification
To your designated contact, from the moment 2way becomes aware.
Deleted after you leave
Personal data is deleted or returned within 30 days of termination.
Compliance at a glance
Where a certification is still in progress, we say so with a date rather than an adjective.
GDPR
Compliant. Personal data is processed under the EU General Data Protection Regulation. Records of processing are maintained under Article 30, and data subject requests are honored within statutory deadlines.
Data Processing Agreement
Available. A standard DPA with Standard Contractual Clauses for cross-border transfers, signed before any production data is processed.
SOC 2 Type II
In progress. Audit underway. Trust services criteria: Security, Availability, Confidentiality. Target: Q4 2026.
ISO/IEC 27001
In progress. Information security management system under implementation, covering all systems that process customer data. Target: Q4 2026.
10DLC, TCR and TCPA
United States. Brand and campaign registration with The Campaign Registry is handled by 2way for every US customer. Opt-in flows are built for prior express written consent under the TCPA, with double opt-in as the default.
WhatsApp Business Platform
Meta Tech Provider. Business verification, number registration and template approval are handled during onboarding. The WhatsApp Business Account is registered in the customer's name.
How we protect your data
Access is limited, every action on personal data is logged, backups are tested, and the platform is checked for vulnerabilities on a schedule.
Access
Individual accounts with no shared logins, role-based access on a need-to-know basis, multi-factor authentication, quarterly access reviews, and revocation within 24 hours of someone leaving.
Logging
Every access to and operation on personal data is logged. Each contact carries a full consent audit trail, and each campaign a delivery log.
Backups and recovery
Automated daily encrypted backups, with recovery tested at least quarterly. Recovery time objective 4 hours, recovery point objective 24 hours.
Testing
Vulnerability scanning at least monthly and an independent penetration test every year. The summary is available under NDA.
What 2way collects
A short list, on purpose. Anything not on it is not part of a standard deployment. The tag runs in your own Google Tag Manager, under your change process, and your team can switch it off at any time.
Who else touches the data
Every sub-processor is assessed before we use it, bound by a written agreement and reviewed every year. You get advance notice of changes and the right to object. The full list, with the data each one processes, is in the Trust Center.
Amazon Web Services
Hosting, storage and backups. EU (Frankfurt, Dublin).
Meta Platforms
WhatsApp message delivery. EU.
Rakuten Viber
Viber message delivery. Luxembourg.
LINK Mobility
SMS and Viber delivery in Europe. EU.
TextGrid
US SMS and MMS delivery and 10DLC provisioning. US.
The Campaign Registry
US 10DLC brand and campaign registration. US.
Zapier
Optional. Only the data you choose to pass through it. US.
Full list
Other carriers per market, analytics, support tools and transactional email.
What happens when something breaks
Support runs Monday to Friday, 07:00 to 23:00 Central European Time, which covers the whole US East Coast working day. Critical incidents are covered outside those hours too, and a personal data breach is reported to you within 48 hours.
Your data stays yours
You are the controller. 2way is the processor, acting only on your documented instructions.
The contact base, consents and campaign history are yours, exportable in full at any time
The WhatsApp Business Account and 10DLC brand registration are held in your name
Personal data is deleted or returned within 30 days of contract termination
We do not sell personal data, use one customer's data for another, or use customer data to train models
Send us the questionnaire before the kick-off call
We would rather answer it early than discover a blocker in week six. Architecture questions, DPA redlines and sub-processor detail can all be handled before your team books anything.
