Security & how it works

How the connection works

You link WhatsApp by scanning a QR code — the same "linked device" mechanism as WhatsApp Web. Separately, you add CoraPilot to Claude or ChatGPT as an MCP connector and sign in to authorise it. Your AI can then search, read and send messages through that authorised connection.

What we store

• WhatsApp messages that arrive while you're connected, so your AI can search and summarise them.
• Group names and sender names, so results are readable and searchable.
• Your account details and subscription status.

What we don't store

• No AI API keys. You connect your own Claude or ChatGPT — there's no model key for us to hold.
• No plaintext passwords. Passwords are hashed; card details are handled by Stripe, not us.
• No silent access. Nothing is sent on your behalf without your explicit instruction — there are no auto-replies.

Access control

• Sign-in required. The connector uses OAuth 2.1 — the link on its own grants no access.
• No secret-in-URL by default. The legacy "key-URL" is off unless you deliberately switch it on.
• You approve every send. Your AI drafts, you confirm; reading is free, sending is on request.
• Isolated, audited runtimes with full audit logging.

Data lifecycle & your controls

• Disconnect wipes history. Disconnecting WhatsApp deletes the stored messages for a clean slate.
• Trial expiry pauses access. If a trial ends without subscribing, the connector is paused.
• Deletion. Paused, unsubscribed accounts are deleted after 14 days (with reminders first).
• You can disconnect, turn off the key-URL, or delete your account at any time.