WhatsApp API data residency in India
WhatsApp Cloud API data residency is controlled by a setting called local storage. According to Meta's local storage page, it lets a business choose the country where message data is stored at rest, and India is one of the supported countries. This post covers what Meta documents, what it does not, and what WhaBuzz stores. It is not legal advice.
What is local storage on the Cloud API?
Local storage is a per-number option on Meta's Cloud API. Meta describes its purpose in plain terms.
Local storage offers an additional layer of data management control, by giving you the option to specify where your message data is stored at rest.
Meta says businesses in regulated industries such as finance, government or healthcare may prefer a specific country because of regulatory or company policies. You set the country with the data_localization_region field when you register a number, using a two-letter ISO code.
Meta's registration page lists the supported regions. In Asia-Pacific they are Australia (AU), Indonesia (ID), India (IN), Japan (JP), Singapore (SG) and South Korea (KR). Europe, Latin America, the Middle East and Africa, and Canada are also listed, each with their own countries.
How does the data-in-use period work?
Local storage does not mean data never leaves the region. Meta's page says that when using local storage for Cloud API, the data-in-use period is up to 60 minutes. After that period, message content is deleted from Meta data centres outside the specified region and persisted only in data centres within it.
So the guarantee is about data at rest after an hour at most, not about processing. During the data-in-use period the content can sit in Meta's other data centres.
Two more points from Meta's pages:
- Once you enable local storage, you cannot disable or change it directly. You must deregister the number and register it again.
- It is set per phone number, so a platform with many customers decides it number by number.
If you need it, set it at registration. Retrofitting means re-registering, which for a live number is a planned change.
What does Meta not publish?
Be careful about what is missing, because it is easy to assume answers.
On the Meta pages checked for this post (local storage, registration, pricing, throughput and the Solution Provider overview), there is no statement of where Cloud API message data is stored when local storage is not enabled, and no statement that maps local storage to any specific law, such as India's Digital Personal Data Protection Act, 2023. Meta describes the feature in terms of regulatory or company policy, and leaves the legal reading to you.
That absence is not evidence of a problem. It means the question belongs in a written query to Meta, or to your lawyer, before you depend on an assumption. Meta's pages can change, so check the local storage page on the day you decide.
Where does WhaBuzz store data?
WhaBuzz runs on Cloudflare. According to the WhaBuzz home page, Workers are pinned to Mumbai (aws:ap-south-1), and data stays in Cloudflare's Asia-Pacific region, in D1, Durable Objects and R2. The site names a region and a Mumbai pin for Workers. Neither the docs nor the site claims India-only storage.
WhaBuzz publishes a data processing agreement. Per the DPA, the customer is the data controller and WhaBuzz acts as a processor; Cloudflare's network and storage hold WhaBuzz's data in its Asia-Pacific region; a security incident affecting your data is notified without undue delay; and the DPA is governed by the laws of India. The DPA makes no statement about India's DPDP Act. If you need one for procurement, ask support@whabuzz.com in writing and treat the reply as the source.
Two things reduce what WhaBuzz holds. Media is never stored: it is streamed through. And business access tokens are stored encrypted, only until you disconnect the number.
Meta's local storage setting and WhaBuzz's storage are two separate things. The Meta setting governs Meta's data centres, and WhaBuzz's region governs WhaBuzz's own event log.
How long does WhaBuzz keep each kind of data?
Per the Retention guide:
| Data | How long |
|---|---|
| Event metadata (id, type, timestamps, wamid, wa_id, number) | Forever |
Event bodies and the raw Meta payload | Your retention_days, then removed |
| Webhook delivery records and attempts | 13 months |
| Media bytes | Never stored |
| Business access tokens | Until you disconnect the number, stored encrypted |
retention_days is 30, 90, 180 or 365, default 90. Change it with PATCH /v1/tenant. A shorter value removes older bodies at the next cleanup. A longer value applies only to events from then on.
Retention also sets your replay window. Replay is possible only while the body exists, so a short retention shortens how far back you can recover. Because event metadata is kept forever, and that includes wa_id (the customer's WhatsApp identifier), you should decide whether that fits your own policy.
What should Indian businesses do in practice?
- Decide if you need local storage. If your sector or contracts require in-country storage, set
data_localization_regiontoINwhen registering the number, and read Meta's page for the current rules. - Pick the shortest useful retention. WhaBuzz's own guidance is to mirror what you need into your own system from the webhook and keep the shortest retention that serves you.
- Keep consent in your system. WhaBuzz does not manage opt-in or opt-out lists.
- Get answers in writing. For anything a regulator or client will ask about, ask Meta and WhaBuzz and keep the replies.
For tenants on a platform, retention is set per tenant. See building for many businesses for how tenants work, and WhaBuzz vs Meta Cloud API direct for where each stores what.
Frequently asked questions
Does Meta offer local storage in India?
Yes. India (IN) is in the list of supported data_localization_region values on Meta's registration page.
Is local storage the same as data never leaving India?
No. Meta says the data-in-use period is up to 60 minutes. After it, message content is deleted from Meta data centres outside the chosen region.
Is WhaBuzz DPDP compliant?
WhaBuzz publishes a data processing agreement, but no DPDP compliance statement. Ask support@whabuzz.com if you need one in writing.
Where does WhaBuzz store data?
In Cloudflare's Asia-Pacific region, with Workers pinned to Mumbai, per the WhaBuzz home page.
Can I delete event data sooner?
Set retention_days to 30, the shortest option. Event bodies are removed after that. Event metadata is kept.
Related reading
- Retention and Tenants in the docs.
- WhatsApp webhooks that never lose an event for how replay depends on retention.
- All guides by task and the WhatsApp API overview.