Security in RaabtaHQ: who can see what
Each business's data is kept apart from every other business. Inside your account, each person sees what their role allows, private WhatsApp numbers stay private, and the AI can only use the tools you switch on.
- Data kept separate per business
- Keys and passwords encrypted
- Roles you control
- Support sign-ins audited
Suspended at 14:02. Nothing he worked on was lost.
Who can see what
Every role reaches only the records its job needs
Roles down the side, your records across the top. Each cell is the access that role has. The last row is our own support access, shown because you should know it exists.
Owners and admins run the account.
Settings, the team, API keys and every chat, including private numbers.
Agents work the inbox.
They read and reply, and change contacts, deals and bookings. Admin settings stay closed to them, even by direct link.
Viewers read and never send.
Every send button is shown disabled, with the reason.
Doctors see their own patients.
Or every patient, if the clinic chooses. The front desk sees appointments and invoices, never clinical records.
Private numbers stay private.
A member's private WhatsApp number shows its chats only in their own My inbox, and to admins.
Clients see only their applications.
A client portal login opens only the applications it was granted.
Our support access is a logged, one-time sign-in.
Our platform team can sign in to your account as the owner through a one-time link, for support, and every such sign-in is audited.
| Role | Team recordsInbox, contacts, deals | SettingsTeam, API keys, tokens | Clinical recordsNotes, prescriptions | Private-number chatsMy inbox | Client applicationsDocuments, invoices |
|---|---|---|---|---|---|
| Owner / AdminRuns the account | Yes | Yes | Yes | Yes | Yes |
| AgentWorks the inbox | Yes | No | No | No | No |
| ViewerReads, never sends | Read only | No | No | No | No |
| DoctorClinic edition | Own only | No | Own only | No | No |
| Private number ownerAny member with their own number | By their role | No | No | Own only | No |
| Client portal userBusiness setup edition | No | No | No | No | Granted only |
| RaabtaHQ supportOur own team | Only through a one-time, audited sign-in as the owner, for support. | ||||
✓ the role has access · Own only: their own patients, or their own number's chats · — no access. A doctor sees every patient if the clinic allows it.
Roles
Each person sees what their job needs
Four roles come with every account: owner, admin, agent and viewer. Industry editions add job roles on top, such as Doctor on a clinic account. Data a role can't read is hidden, not shown as zero, so nobody reads a total that only counts part of the picture.
| Role | Can see | Can do | Cannot |
|---|---|---|---|
| Owner | Everything in the account | Everything, including deleting the account | Have their role changed by anyone |
| Admin | Everything, including every private number's chats | Manage the team, settings and API keys; answer the AI's approval requests; opt contacts back in | Delete the account; change their own role or the owner's |
| Agent | Shared inbox, contacts, deals, bookings | Reply, assign, change records, opt someone out | Open admin settings, even by direct link |
| Viewer | What the account shows | Read | Send anything; buttons are disabled with the reason |
| Doctor (clinic edition) | Own diary, own patients' clinical records, own earnings | Prescribe, invoice their own treatments | See clinic-wide finances or other doctors' patients |
| Front desk (clinic edition) | Appointments and invoices | Register and book patients | See allergies, conditions or clinical records |
| Private number owner | Their private number's chats in My inbox | Reply from their own number | Their chats never show in the shared inbox or dashboards |
| Client portal user (business setup) | Only the applications they were granted, with documents and invoices | Upload, fill in forms, acknowledge | See the firm's contacts, chats or inbox; open other applications |
| The AI assistant | Only what its switched-on tools allow | Act within those tools; anything that can't be undone asks first | Read clinical records; read passport, Emirates ID or TRN numbers |
| RaabtaHQ platform support | Your account, only through a one-time, audited sign-in as the owner | Help with setup and support | Work in your inbox day to day |
A doctor is a team member, so shared chats and contacts stay readable to them through the API, even though their menu has no shared inbox.
Separation
Your account is yours alone
Every contact, chat, deal and booking belongs to one business account. Access is checked on every screen, so a person signed in to one account sees only that account's data. An API key works on exactly one account. Every page in the app is private unless we have deliberately made it public, so a new screen is protected the moment it exists.
Official connections.
WhatsApp, Instagram and Messenger connect through Meta's own business APIs, and incoming Meta messages are checked to prove they came from Meta. Your own number linked by QR code is the exception: that connection is unofficial, and we label it so wherever it appears.
Our own team.
Our platform admins work in a separate admin area that is refused your account's records. To help with support, they can sign in to your account as its owner through a one-time link, and every such sign-in is audited.
Run it on your own servers.
RaabtaHQ can be self-hosted if your business needs that. Ask us on the demo.
One account never sees another's records.
Credentials
Secrets are encrypted, and keys do only what you allow
The credentials that connect your account to other services are stored encrypted: WhatsApp access tokens, AI provider keys, voice service credentials and the secrets of your own custom connections. AI provider keys are never shown again after you save them. Mailbox passwords and sign-in tokens are encrypted and can't be read from the browser, even by an admin.
API keys with a narrow job.
Only admins and owners create them, and each one gets an explicit set of permissions. A key can do what its permissions allow and nothing more, whoever made it.
Shown once, then a fingerprint.
API keys and Claude connection links are stored only as one-way fingerprints. You copy the secret once; after that nobody can read it back, including us.
Expiry, IP allowlist and limits.
A key can expire after 30, 90, 180 or 365 days (90 by default) or never, be limited to your own IP ranges, and have its own request limit. Admins get a notice a week before a key expires.
Revoked means revoked.
Regenerate a key's secret in place, or revoke it with a reason. A revoked key stays listed for the record and can never be revived. Each key shows its usage and every refused attempt.
Signed webhooks.
Every webhook RaabtaHQ sends is signed, so your system can check it really came from us. Addresses that point at private or internal networks are refused, and internal notes on website enquiries are never sent out.
Hashed before it leaves for your ad accounts.
Phone numbers, names and emails used for ad tracking are hashed before they are stored for sending.
Shown once, then stored as a fingerprint.
Bring your questions
Tell us who on your team should see what. We'll set up the roles with you on the call.
We reply in under an hour.
Access
People join by invite, and leave in one click
There is no open signup. We create your account, and your teammates join by an invite link that works once, expires and is shown once.
Suspend without losing anything.
A suspended member is signed out at once, can't sign in again and sees nothing, even in a tab already open. Their chats, deals and records stay where they were, ready to reassign. Unsuspend them and everything comes back.
Only a higher role can act.
The owner can suspend admins and below. An admin can suspend agents, viewers and industry roles, never another admin or the owner. Nobody can suspend themselves.
Sign out of all devices.
One button in Login and security ends every session you have open.
Password resets that expire.
A reset link arrives by email, works once, lasts one hour, and signs you out on every device once the password changes.
You control the AI
The AI works inside the limits you set
Each assistant gets only the tools you switch on, and its reach is narrowed further by role. You choose which actions wait for your approval. Anything that can't be undone always asks, and that can't be switched off.
Silence is never a yes.
A question the AI asks your team has a deadline between one hour and a week. If nobody answers, the action doesn't happen. Only admins can answer approval requests.
A person taking over stops it.
When someone on your team takes a chat, the AI stops replying there.
Drafts stay drafts.
Suggested replies and summaries can only read. Nothing is sent without a person pressing send.
Staff numbers left alone.
Numbers on your excluded list, such as your own doctors, get no AI replies, labels or transcripts. A customer who sends STOP is opted out and the AI stands down.
Every chat can be read back.
Each chat the AI handled reads as a short story of what it checked, changed and said.
Needs you, 2 hours 15 minutes left: move Bilal to Saturday 15:30 with Dr. Amara? Approve or decline. If nobody answers, nothing is moved.
Records out of its reach
Some records the AI can never open
The clinic assistant has no tool that can open a clinical record, so it can't repeat one to a stranger. In a patient chat it acts only for that patient and the family members linked to them.
Clinic edition.
Doctors see their own patients' records, or all of them if the clinic allows. Booking a patient doesn't give a doctor their history. Removing, suspending or marking a doctor inactive ends their access. Clinical files open through short-lived links, and only an admin can delete one. A doctor's phone, email and commission are private to admins and that doctor.
Business setup edition.
The AI never reads passport, Emirates ID, TRN or renewal reference numbers, and answers only about the person it is talking to. Staff other than owners and admins see only the clients they created or were assigned. PRO officers see no money at all.
Study abroad edition.
No role reaches across branches, and a record with no branch is visible only to admins. Colleagues see a private student's name but not their phone or email. The AI's student summary leaves out passport number and date of birth.
Claude and MCP
Connect Claude as yourself, never as more
A team member can connect Claude to the account. The connection acts as that person and can never do more than they can in the app: a front-desk agent gets front-desk reach, a doctor only their own patients, a viewer only reads.
Read-only to start.
New connections can read but not write, and sensitive data is off. Each tool is switched on one by one.
Some things are never available.
Deleting the account, transferring ownership, changing members or roles, and managing keys or channel setup.
Links expire.
90 days by default, a year at most. Regenerating a link stops the old one at once, and admins can revoke anyone's connection.
A log without the contents.
Each call records who used which tool and how it went, never message text, phone numbers, emails or clinical values. On a clinic account, clinical reads are off by default and every one is logged.
It can never do more than Sara can.
What the public sees
The few pages customers see show only what they need
Your booking page.
It shows only your shopfront details. Any failure gives the same “not found” page, so nobody can probe which businesses use RaabtaHQ.
Review links.
Your public review links appear only after a customer gives a rating at or above the level you set.
Website chat.
The chat widget can be limited to your own website domains.
Incoming email.
Scripts and dangerous links are removed from email before your team opens it, and remote images stay blocked until someone chooses to show them.
Notifications.
Only the person a notification is for can read it, and notifications can't be created from a browser.
The honest part
What we won't claim
That our staff can never see your account.
Our platform team can sign in as your owner through a one-time, audited link, for support.
That your own linked number is official.
Linking a number by QR code is unofficial. Everything above about official Meta connections excludes it.
That every number can be private.
Private numbers need to be switched on for your account first; ask us. On the study abroad edition they are on from the start.
That linked family members are walled off from each other.
On a clinic account, patients linked as a family can see each other's appointments and balances through the assistant.
Questions
Who can see our chats?
Your team, according to their roles. Agents and viewers see the shared inbox. Chats on a member's private number are seen only by that member and your admins. Our platform team can sign in to your account as the owner through a one-time, audited link, for support.
Can a member we let go still get in?
No. Suspend them and they are signed out at once and can't sign in again. Their chats and deals stay in the account for you to reassign.
Can the AI read medical records?
No. The clinic assistant has no tool that can open a clinical record. Doctors and admins read records; the front desk and the AI can't.
Where is our data hosted?
Ask us on the demo call and we'll go through it. If your data has to stay on your own servers, RaabtaHQ can be self-hosted.
Book a demo
See who sees what in your own account
A 30-minute call. We set up roles for your team, show a private number in My inbox, and walk through what the AI can and can't reach.
- Roles for owner, admin, agent and viewer
- A suspended member signed out at once
- The approval queue for the AI
We reply in under an hour.