Enterprise security controls

Learn how DoubleTick’s enterprise security validation helps protect your brand, maintain customer trust, and control your messaging operations automatically.

Plan Availability: Enterprise Plan (Pro plan users can buy the Enterprise Security add-on under Billing & Invoices → Purchase Add-on or by contacting their Account Manager).

What’s covered

What is Enterprise Security Validation?

Think of this feature as a smart digital gatekeeper for your DoubleTick account. Before any outbound WhatsApp message goes to a customer, DoubleTick automatically checks it against rules set by your company.

If it follows your rules: The message goes out immediately.
If it breaks a rule: (e.g., trying to send a late-night text or sending too many messages at once), DoubleTick automatically blocks it in the background—without slowing down your team's day-to-day workflow.

Why Should Your Business Use It?

Setting up message validation goes beyond technical safety—it directly protects your business:

Prevents account bans: Blocks accidental spam so your WhatsApp business number stays in good standing.
Keeps communication respectful: Prevents messages from sending late at night or cluttering customer inboxes with repeat texts.
Saves money: Stops accidental duplicate campaigns from firing and wasting message credits.
Saves time: Automatically enforces your team's messaging policies across all departments.
Ensures international compliance: Automatically adjusts sending hours based on customer time zones.

Core Security Controls You Can Set Up

You can tailor these basic guardrails to match how your team works:

Spam Protection: Cap how many messages a customer can receive in a set period (e.g., max 5 messages per hour).
Sending Time Restrictions: Define official working hours for outreach (e.g., 9:00 AM to 6:00 PM). Out-of-hours messages get blocked automatically.
Template Cooldowns: Prevent the exact same promo or update message from spamming a customer repeatedly (e.g., enforce a 24-hour wait between identical messages).
Message Type Controls: Choose whether automated systems or team members are allowed to send template messages, free-form custom replies, or both.

Smart Features: Bypass, Timezones & Feedback

Instant Support Bypass: When a customer sends you a message, their incoming text bypasses outbound rules. This ensures your support team can reply instantly without delays.
Timezone Accuracy: Outbound sending hours rely on your default timezone setting (defaults to Asia/Kolkata). Make sure your timezone is set correctly so business hours align properly.
Real-time Pass/Fail Status: DoubleTick gives an immediate "allowed" or "rejected" status for every message, keeping your team and internal tools informed.

How to Connect Your Security API

If your company uses a custom security system or API to scan content, DoubleTick will send messages to your system for approval before delivering them to customers. Setup Steps:

Work with your developers to build and test an HTTPS Security Endpoint.
Log in to DoubleTick and navigate to: Settings → Enterprise Security → Block Sensitive Information.
Turn on the desired text or media security actions.
Paste your server URL into the Security API Endpoint URL field.
Click Save & Connect.

How the Security API Responds

When DoubleTick sends a message payload to your security system, your server must return one of these actions:

Mask: Replaces sensitive text (like passwords or private IDs) with hidden characters.
Blur: Obscures sensitive media files or images.
Reject: Completely blocks the message or media from sending.
Allow: Permits normal delivery when no sensitive content is found.

Key takeaways

Enterprise validation acts as an automated filter to stop non-compliant or repetitive messages.
Protects your WhatsApp number quality rating and prevents accidental customer spam.
Saves costs by stopping duplicate or runaway automated campaign sends.
Incoming customer inquiries automatically bypass outbound checks for uninterrupted support.

Frequently asked questions

Do we call the DoubleTick API for every message?

No. Configure your Security API endpoint in DoubleTick. DoubleTick calls that endpoint for each eligible message or attachment.

Where do we configure the Security API endpoint?

Go to Settings → Enterprise Security → Block Sensitive Information. Enable the required text or media action. Then add the URL in Security API Endpoint URL and select Save & Connect.

What happens when sensitive information is detected?

DoubleTick applies the action selected for that content type. Text can be masked or rejected. Media can be blurred or rejected.

What happens when the API finds no sensitive information?

Your API returns an allow decision. DoubleTick continues normal message processing.

Where can I find the request payload and response fields?

Confirm the required payload, authentication, headers, and response schema with your engineering team before enabling the integration.