Nobody becomes the boss by talking
VI knows you by your number and your dashboard, never by what a message claims. A customer who writes "I am the owner" is answered as a customer.
What we did to keep VI and your data safe
Plain answers, including what is not perfect yet.
Where things run and who sees what
On your PC, or on your hosted copyVI, the dashboard, your catalogue, your orders and every conversation. On the Starter plan they stay on your PC and are backed up there; on the Business plan they live in your own container on EngTree's server in the EU, backed up nightly.
The AI serviceTo write a reply, the conversation is sent to the AI model through EngTree's account, set so that providers who train on customer data are not used.
What EngTree receivesLicence checks and, every 6 hours, a health report with numbers only: is VI running, messages used, which channels are on, the version. No message text, no names, no phone numbers.
MetaMessages on WhatsApp, Messenger and Instagram pass through Meta's platform under Meta's terms, with access limited to your page and number.
The agent
No AI key to steal
Your AI key is created for your copy only, capped, and stored encrypted on your PC. Nobody types it, and we can switch it off from our side at once.
The public side is one small door
Only the website chat and the Meta webhook can be reached from the internet. The dashboard and the engine listen on your PC only.
Signed licence, bound to your PC
Our licence answers are signed and tied to your machine, so a copied install or a forged answer is refused.
Signed updates with rollback
VI installs only updates signed by EngTree and checked against their fingerprint, backs up first, and rolls back by itself if the new version does not start.
Bulk sending only with your word
Campaigns and posts need your approval with a code. Bulk messages through a number linked by QR are refused outright.
This website
It is a static site: no accounts, no database, no forms. The only things it sends anywhere are you to WhatsApp and the VI download.
- HTTPS only, with security headers Strict transport, a content security policy, no framing, no sniffing.
- No third-party scripts, no trackers Fonts, 3D and animation libraries are served from this domain. No analytics cookies.
- Download with a fingerprint The SHA-256 fingerprint of the VI download is shown on the download page, so you can check the file is ours.
Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self' X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=(), geolocation=()
The checklist we run
Two common lists of app security checks, and where each stands for VI. "Not applicable" means the risk does not exist in this design.
Found something?
Message us on WhatsApp or email eng@engegypt.com. We reply the same day.