# Messaging Integration Security Checklist for WhatsApp, Teams and Slack > Source: https://netray.co/tools/messaging-integration-security-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A 30 point checklist covering tokens, webhook verification, approver identity, data minimization, logging and incident handling for chat integrations. ## Category compliance-legal ## Audience - IT security - Integration developer - IT manager ## Tool **Kind:** checklist **Groups:** #### Credentials and access **Items:** **Text:** API tokens and signing secrets are stored in a secrets manager, not in source code or chat **Critical:** true **Text:** Tokens use the least scopes needed, for example chat:write only **Critical:** true Separate apps or numbers exist for test and production Named owners exist for each app, WhatsApp Business Account and bot registration Token rotation is scheduled and tested, and former staff access is removed **Text:** Admin access to Meta Business, Slack and Entra consoles requires MFA **Critical:** true #### Inbound webhooks and callbacks **Items:** **Text:** Every inbound request signature is verified (X-Hub-Signature-256, X-Slack-Signature or equivalent) **Critical:** true **Text:** Timestamps are checked to block replayed requests **Critical:** true Webhook endpoints use HTTPS with a valid certificate only Handlers respond fast and process work asynchronously **Text:** Duplicate deliveries are handled idempotently using message or event IDs **Critical:** true Payload size and rate limits protect the endpoint Verify token for the subscription handshake is random and kept secret #### Identity and authorization **Items:** **Text:** Chat users are mapped to ERP users through a verified identity, not a typed name **Critical:** true **Text:** The ERP role is checked on every action, regardless of what the chat user is shown **Critical:** true Approvals above a defined value require sign-in to the ERP or a second factor **Text:** Customer WhatsApp numbers are verified before returning account-specific data **Critical:** true Bots are read-only by default and write actions need explicit confirmation Group and channel membership is reviewed for sensitive notifications #### Data handling and privacy **Items:** **Text:** Messages avoid personal data, bank details, passwords and confidential pricing **Critical:** true **Text:** Consent to message each contact is recorded and checked before sending **Critical:** true Opt-out requests are honored across all connected systems Retention periods are defined for chat logs, transcripts and media Cross-border data flows are documented against local data protection law AI or chatbot answers use only approved data sources and cite them Attachments are scanned and limited by type and size #### Monitoring, logging and response **Items:** **Text:** Every send, click and decision is logged with user, time and document reference **Critical:** true Logs avoid message secrets and are protected from tampering Alerts exist for failed sends, signature failures and unusual volume Quality rating, block rate and rate limit headroom are monitored **Text:** A runbook covers token leak, number ban and webhook outage **Critical:** true A kill switch can pause all outbound messages quickly The integration is included in the periodic access review and penetration test scope **Scoring Note:** Any unchecked critical item should be fixed before go-live. Treat the rest as a prioritized backlog. This checklist is a general aid and not a certification. ## Content **Intro:** Chat integrations connect a public messaging platform to systems that hold orders, prices and approvals. This checklist covers the controls that most often go missing: secrets, webhook verification, identity, data handling and response planning. **Sections:** #### How to use the checklist **Body:** Run it as a design review before build and again before go-live. Assign each group to the person who can answer it: platform admin for credentials, developer for webhooks, ERP owner for authorization, privacy lead for data, operations for monitoring. Tick items only where you have seen the evidence, such as a configuration screen or a test result. Items you cannot tick become your remediation list, and the critical ones block release. #### Why these controls matter **Body:** A leaked token lets an attacker send messages as your company. An unverified webhook lets anyone fake an approval click. A chat name mapped to an ERP user without verification turns a message into a privilege escalation. Personal data in a template leaves your control the moment it is delivered. Most of these failures come from convenience shortcuts during a proof of concept that quietly become production. **Bullets:** - Verify signatures on every inbound call - Check ERP roles at the ERP, not in the chat - Keep sensitive values out of message text - Log decisions for audit #### Common mistakes **Body:** Teams often share one token across test and production, forget to expire the verify token after setup, skip replay protection, log full message bodies including personal data, and have no plan for a banned number or a suspended app. Another gap is leaving a prototype bot running with broad scopes after the project ends. Put the integration in your asset inventory and review it at least yearly. **Cta:** Netray designs private, read-only-by-default integrations between ERP systems and chat platforms, and can review an existing design against this list. **Faq:** #### Is this checklist enough for compliance? **Answer:** No. It is a practical technical aid. Formal compliance with standards such as ISO 27001 or data protection law needs your own risk assessment and, where relevant, legal advice. #### Which controls matter most? **Answer:** Secret management, inbound signature verification, verified identity mapping and ERP-side authorization. These four prevent the most serious abuses, so fix them first. #### Do these apply to Microsoft Teams bots too? **Answer:** Yes. Teams bots need token validation of incoming activities, Entra ID based identity mapping and the same data handling and logging controls. #### How often should I repeat the review? **Answer:** At each major change and at least yearly. Also review after any security incident, platform policy change or change of solution provider. ## Search terms messaging integration security checklist, whatsapp api security checklist, slack app security review checklist, teams bot security checklist, webhook security checklist, chatbot security review erp, whatsapp business api compliance checklist, chat integration risk assessment --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json