Security and data
Reliable, private and kept in Singapore
How HeyPing keeps your business messaging running and your customers' details safe, in plain language.
99.95%
Uptime target
Built on Google Cloud and Firebase with automatic scaling, queued sending and round-the-clock monitoring.
Singapore
Data residency
Workspace data is stored in Google Cloud's Singapore region. Singapore businesses come first.
Direct
Straight to Meta
HeyPing connects to Meta's official WhatsApp Cloud API with no third-party provider in between.
Data residency
What is stored where
We're specific, because “your data is in Singapore” should mean something.
| Data | Where |
|---|---|
| Workspace data: customers, consent records, messages, campaigns, templates, settings | Google Cloud, Singapore region (asia-southeast1) |
| HeyPing app and API | Google Cloud and Firebase, Singapore region (asia-southeast1) |
| Sign-in accounts (your team's name, email and login) | Firebase Authentication, a Google service that runs globally |
| WhatsApp messages on their way to and from customers | Meta's WhatsApp Cloud API, under Meta's terms and your own WhatsApp Business account |
| HeyPing subscription payments | Stripe. HeyPing never stores card numbers. |
Meta processes WhatsApp messages as part of delivering them, under Meta's own terms with your business. HeyPing's uptime figure is a target that guides how we build and run the service, not a contractual service level.
How we protect it
Security controls
Encrypted WhatsApp access
The access Meta gives HeyPing to send for you is encrypted at rest and only used by our servers. It never reaches a browser.
Roles for your team
Owners, admins, marketers, agents and viewers each see and do only what their role allows.
Limited HeySheep access
Our staff can see account health, such as plan and number quality, but not your customer lists or message content.
Opt-outs honoured everywhere
When a customer stops messages, every campaign and connected app respects it.
Signed webhooks
Events HeyPing sends to your systems are signed, so they can check the message really came from us.
Encrypted in transit
All traffic between your browser, HeyPing, Meta and your systems uses HTTPS.
Privacy and PDPA
Consent you can show, privacy you can trust
Under Singapore's PDPA, your business is responsible for your customers' data. HeyPing acts as your data intermediary and gives you the tools to do it right.
- Every opt-in records how, when and where the customer agreed, so you can show it if asked.
- Marketing and service messages have separate consent, as the rules expect.
- A “Stop promotions” button and STOP replies opt customers out straight away, across every campaign and app.
- Customers who never agreed to promotions can't be added to a promotional campaign.
- You can export or delete a customer's details from one screen.
Found a security issue or have a privacy question? Email contact@heysheep.sg.