> ## Documentation Index
> Fetch the complete documentation index at: https://fliqr.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Account Security Settings and Data Handling in Fliqr AI

> Configure two-factor authentication, manage API key security, understand data retention policies, and review Fliqr AI's compliance posture.

This page covers the security controls available to you as a Fliqr AI account holder, the data retention policies that govern how long your information is stored, and the compliance context that applies to your use of the platform. Understanding these topics helps you operate securely and meet your own obligations to the contacts you communicate with.

## Two-Factor Authentication

Enabling two-factor authentication (2FA) requires anyone logging into your account to present a time-based one-time password (TOTP) in addition to their password. This prevents unauthorized access even if a password is compromised.

2FA is recommended for all accounts and required for Owner and Admin roles.

<Steps>
  <Step title="Open Security settings">
    Go to **Settings → Security**.
  </Step>

  <Step title="Enable 2FA">
    Click **Enable Two-Factor Authentication**.
  </Step>

  <Step title="Scan the QR code">
    Open your authenticator app (Google Authenticator, Authy, 1Password, or any TOTP-compatible app) and scan the QR code displayed on screen.
  </Step>

  <Step title="Enter the verification code">
    Type the 6-digit code currently shown in your authenticator app.
  </Step>

  <Step title="Save">
    Click **Save**. 2FA is now active on your account. Store your backup codes in a secure location — you'll need them if you lose access to your authenticator app.
  </Step>
</Steps>

## API Key Security

API keys grant programmatic access to your account. Treat them with the same care as passwords.

* **Keys are shown once.** When you create an API key, the full key value is displayed only at the moment of creation. Copy it immediately and store it in a secrets manager (such as AWS Secrets Manager, HashiCorp Vault, or your CI/CD platform's secret store).
* **Never put keys in source code.** Even in private repositories, embedding API keys in code is a security risk. Use environment variables or a secrets manager.
* **Rotate keys regularly.** Go to **Settings → API → Revoke and Regenerate** to replace an existing key. Update all systems using the old key before revoking it.

<Warning>
  If you believe an API key has been exposed — for example, accidentally committed to a public repository — revoke it immediately from Settings → API. Assume any exposed key has been used.
</Warning>

## Data Retention

| Data type             | Retention period       |
| --------------------- | ---------------------- |
| Conversation messages | 12 months by default   |
| Contact records       | Until manually deleted |
| Call recordings       | 30 days                |
| Delivery logs         | 90 days                |

### Deleting Contact Data

If you need to delete a contact and all associated messages (for example, in response to a GDPR right-to-erasure request):

<Steps>
  <Step title="Open Contacts">
    Go to **Contacts** in the left navigation.
  </Step>

  <Step title="Select the contact">
    Find and select the contact you need to delete. You can also select multiple contacts if you're processing a batch deletion.
  </Step>

  <Step title="Delete">
    Click **Delete** and confirm the action. This permanently removes the contact record and all associated messages from Fliqr AI's servers. This action cannot be undone.
  </Step>
</Steps>

<Warning>
  If a contact exercises their GDPR right to erasure, you are responsible for deleting them from Fliqr AI. Fliqr AI does not automatically process deletion requests submitted by your end-users to you — you must action these requests manually in the Contacts panel.
</Warning>

## Platform and Compliance

**Meta Business Partner status.** Fliqr AI is an official Meta Business Partner. WhatsApp and Instagram channel connections use Meta's official Messaging API. This means your WhatsApp communications are governed by Meta's approved messaging infrastructure, not unofficial automation methods.

**Infrastructure.** Fliqr AI stores contact and message data on ISO 27001-certified infrastructure.

**Data Processing Agreements (DPA).** If your use case requires a formal DPA — for example, to satisfy GDPR Article 28 requirements — contact Fliqr AI support to request one. DPAs are available to Pro customers.

**GDPR.** Fliqr AI operates as a data processor on your behalf. You remain the data controller for the contacts you engage with. This means your privacy policy, consent collection, and deletion obligations apply to your use of Fliqr AI.

## What's Next

<CardGroup cols={2}>
  <Card title="Team & Admin" href="/docs/account/team-admin">
    Control who on your team has access to what by assigning roles.
  </Card>

  <Card title="API Authentication" href="/docs/api-reference/authentication">
    Learn how to create and manage API keys for programmatic access.
  </Card>
</CardGroup>