WhatsApp API for large Kuwait organisations, governed, not improvised

Gallabox's Enterprise plan has no list price: seats, the pool of AI credits and API rate limits are set in the contract. It removes the plan caps, so broadcast contacts, active bot flows and drip sequences are unlimited, and it adds the controls a security review asks for: SSO/SAML, IP whitelisting and custom role-based access control.

On the service side it includes a dedicated customer success manager, an uptime SLA, a custom support response time with a dedicated Slack channel, custom integrations, and Gallabox's AI Solutions Engineer service. Contracts can run beyond one year, and Gallabox lists a discounted markup on Meta's message fees for Enterprise; the size of the discount is part of the quote. Setup through Aahfil is free here as on every plan: we connect the numbers, prepare and submit business verification (Meta decides the outcome), and write the first templates.

What it doesn't change: Meta's per-message rates are the same for everyone, the messaging-limit and template rules still apply, and no plan can make Meta approve a template or grant a blue check. Gallabox states it is SOC 2 Type II compliant and an official Meta Business Partner; ask for the current report during your vendor review rather than relying on the statement alone.

Large Kuwait groups often run several brands under one company: restaurant concepts, retail chains, clinics, car dealerships. On WhatsApp each brand needs its own number and a display name that matches that brand; Meta rejects generic names and names that include words like 'official'. Extra numbers are channel add-ons, and on Enterprise their number and price are set in the contract.

Plan the Meta structure before the numbers. Since October 2025 the messaging limit, meaning how many people you can reach outside an open chat in 24 hours, belongs to the business portfolio and is shared by every number in it. A big campaign on one brand uses capacity the others may need that day. Some groups keep all brands in one portfolio, which pools volume discounts and keeps oversight in one place; others separate them. We map that with your team before anything is registered.

The blue check is earned per number and needs a verified portfolio, at least 30 days on the platform, two-step verification and an approved display name. Verification alone gives no badge, and the decision is Meta's, not ours or Gallabox's.

In a large organisation the risk isn't that WhatsApp fails; it's that someone sends the wrong message to a very large list. Custom roles decide who can build templates and flows, who can broadcast and who can only reply. The approval itself we set up as a process: a named approver for each brand signs off the wording and the category before anything goes to Meta.

Bilingual governance needs its own rule. Arabic and English templates should be written by people fluent in each, approved as a pair, and kept in step when either changes. We keep a template register per brand, with language, category, owner and last review date, so a price change doesn't leave the Arabic version quoting last month's offer.

Meta can reclassify a utility template as marketing if the wording sells, which changes what each send costs. A central review catches that pattern across brands before it shows up on the invoice.

Banks, apps, loyalty programmes and online services send one-time passwords on WhatsApp. These are authentication templates. In Kuwait they cost $0.0091 today under the Rest of Middle East card, and $0.044 from 1 October 2026, when Kuwait becomes its own market.

Meta also has an authentication-international rate, $0.12 for Kuwait from the same date. It applies only to businesses Meta designates as eligible, with notice, and not when the business's primary location is in the same country as the customer. A Kuwait-based business sending codes to Kuwaiti numbers pays the standard rate; a regional group sending from elsewhere should check its status.

Utility and authentication messages get volume discounts, counted per business portfolio, per market and per category each month. Authentication stays at the list rate up to 300,000 messages a month and utility up to 100,000; above that the rate steps down in stages, to as much as 25% off at the highest volumes. For OTP-heavy services that's a real budget line, and one more reason to plan the portfolio structure carefully.

Customer chats hold personal data. In Kuwait, the CITRA Data Privacy Protection Regulation is the framework your legal team will check the setup against. We don't give legal advice, but we build the setup so their questions have answers: who can see what, who can export contacts, how opt-in is recorded, and what retention your own policy requires.

Ask where the data is hosted. Gallabox lists data-residency and private-cloud options on Enterprise without naming GCC locations, so if your policy requires data to stay in a particular country, get the answer written into the contract before you sign.

Budget in US dollars. Gallabox prices Kuwait in USD, and Meta has no Kuwaiti dinar rate card, so plan fees and message fees both arrive as dollar amounts. Salesforce isn't among the integrations we can verify; if it's your CRM, we scope a custom connection through the API, and Enterprise includes custom integrations for exactly that kind of gap.