> For the complete documentation index, see [llms.txt](https://learn.doubletick.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://learn.doubletick.io/settings/enterprise-security/enterprise-security-controls.md). # Enterprise security controls Learn how DoubleTick’s enterprise security validation helps protect your brand, maintain customer trust, and control your messaging operations automatically. **Plan Availability**: Enterprise Plan *(Pro plan users can buy the Enterprise Security add-on under Billing & Invoices → Purchase Add-on or by contacting their Account Manager).* #### What’s covered * [What is Enterprise Security Validation?](#what-is-enterprise-security-validation) * [Why Should Your Business Use It?](#why-should-your-business-use-it) * [Core Security Controls You Can Set Up](#core-security-controls-you-can-set-up) * [Smart Features: Bypass, Timezones & Feedback](#smart-features-bypass-timezones--feedback) * [How to Connect Your Security API](#how-to-connect-your-security-api) * [How the Security API Responds](#how-the-security-api-responds) * [Key takeaways](#key-takeaways) * [Frequently asked questions](#frequently-asked-questions)
#### What is Enterprise Security Validation? Think of this feature as a smart digital gatekeeper for your DoubleTick account. Before any outbound WhatsApp message goes to a customer, DoubleTick automatically checks it against rules set by your company. * If it follows your rules: The message goes out immediately. * If it breaks a rule: (e.g., trying to send a late-night text or sending too many messages at once), DoubleTick automatically blocks it in the background—without slowing down your team's day-to-day workflow. #### Why Should Your Business Use It? Setting up message validation goes beyond technical safety—it directly protects your business: * **Prevents account bans**: Blocks accidental spam so your WhatsApp business number stays in good standing. * **Keeps communication respectful**: Prevents messages from sending late at night or cluttering customer inboxes with repeat texts. * **Saves money**: Stops accidental duplicate campaigns from firing and wasting message credits. * **Saves time**: Automatically enforces your team's messaging policies across all departments. * **Ensures international compliance**: Automatically adjusts sending hours based on customer time zones.
#### Core Security Controls You Can Set Up You can tailor these basic guardrails to match how your team works: * **Spam Protection**: Cap how many messages a customer can receive in a set period (e.g., max 5 messages per hour). * **Sending Time Restrictions**: Define official working hours for outreach (e.g., 9:00 AM to 6:00 PM). Out-of-hours messages get blocked automatically. * **Template Cooldowns**: Prevent the exact same promo or update message from spamming a customer repeatedly (e.g., enforce a 24-hour wait between identical messages). * **Message Type Controls**: Choose whether automated systems or team members are allowed to send template messages, free-form custom replies, or both. #### Smart Features: Bypass, Timezones & Feedback * **Instant Support Bypass**: When a customer sends *you* a message, their incoming text bypasses outbound rules. This ensures your support team can reply instantly without delays. * **Timezone Accuracy**: Outbound sending hours rely on your default timezone setting (defaults to `Asia/Kolkata`). Make sure your timezone is set correctly so business hours align properly. * **Real-time Pass/Fail Status**: DoubleTick gives an immediate "allowed" or "rejected" status for every message, keeping your team and internal tools informed. #### How to Connect Your Security API If your company uses a custom security system or API to scan content, DoubleTick will send messages to *your* system for approval before delivering them to customers.\ **Setup Steps**: * Work with your developers to build and test an HTTPS Security Endpoint. * Log in to DoubleTick and navigate to: **Settings → Enterprise Security → Block Sensitive Information**. * Turn on the desired text or media security actions. * Paste your server URL into the Security API Endpoint URL field. * Click **Save & Connect**. #### How the Security API Responds When DoubleTick sends a message payload to your security system, your server must return one of these actions: * Mask: Replaces sensitive text (like passwords or private IDs) with hidden characters. * Blur: Obscures sensitive media files or images. * Reject: Completely blocks the message or media from sending. * Allow: Permits normal delivery when no sensitive content is found. #### Key takeaways * Enterprise validation acts as an automated filter to stop non-compliant or repetitive messages. * Protects your WhatsApp number quality rating and prevents accidental customer spam. * Saves costs by stopping duplicate or runaway automated campaign sends. * Incoming customer inquiries automatically bypass outbound checks for uninterrupted support. #### Frequently asked questions
Do we call the DoubleTick API for every message? No. Configure your Security API endpoint in DoubleTick. DoubleTick calls that endpoint for each eligible message or attachment.
Where do we configure the Security API endpoint? Go to **Settings → Enterprise Security → Block Sensitive Information**. Enable the required text or media action. Then add the URL in **Security API Endpoint URL** and select **Save & Connect**.
What happens when sensitive information is detected? DoubleTick applies the action selected for that content type. Text can be masked or rejected. Media can be blurred or rejected.
What happens when the API finds no sensitive information? Your API returns an allow decision. DoubleTick continues normal message processing.
Where can I find the request payload and response fields? Confirm the required payload, authentication, headers, and response schema with your engineering team before enabling the integration.
#### **Suggested articles:** [How to Configure PII Masking and Blocking with Your Security API](/settings/enterprise-security/custom-pii-masking-and-blocking.md)\ [How to Set Up IP Access Control](/settings/enterprise-security/ip-access-control.md)\ [How to Control Team Member Login Access with Device Management](/settings/enterprise-security/control-team-member-login-access-with-device-management.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://learn.doubletick.io/settings/enterprise-security/enterprise-security-controls.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.