Gallabox Alternative: What BSUID and Meta’s Repricing Do Not Reach

Is Gallabox affected by WhatsApp's BSUID change and Meta's 2026 pricing update?

Yes. Gallabox is built on Meta's WhatsApp Cloud API — its own documentation covers choosing between the Cloud API and coexistence — so two things reach its customers that Gallabox does not control: a reported change to how Meta keys users (BSUID), and Meta's own per-message rate card. A business solution provider transmits both by design. Neither is confirmed by Meta publicly.

BSUID is reported, not confirmed. Twilio's changelog lists a business-scoped user ID field as required starting June 2026, and Microsoft's Azure Communication Services documentation and Alibaba Cloud's WhatsApp guide describe the field alongside WhatsApp usernames. No general switch date appears in the material we checked. Treat every date as provider-reported and re-check it at source before planning.

The pricing change is separate and commercial. It is covered under "How does Meta's per-message pricing reach a Gallabox invoice?" below.

What the two changes share is the layer they live in. Both are properties of Meta's platform, not of Gallabox's software. A self-hosted app on your own number holds no Meta-issued identifier in its schema and no Meta billing line in its path, so neither change has an object to land on. That is a statement about architecture, not about morality.

How do Gallabox, the Cloud API and the self-hosted alternatives compare?

Six routes, three pricing models and two risk profiles. Gallabox and Twilio resell Meta's rails. The Cloud API is Meta's rails bought direct. Evolution API, WAHA and SocialMate link your own number over the Web protocol. The table below compares all six on pricing model, identity, storage and ban risk.

Read two columns first: pricing model (metered versus flat) and ban or account risk. They decide year two, and month one looks easy on every route, which is exactly what misleads buyers.

Rates vary by market and by category, so the only correct reference is the dated rate card for your country. Provider plan prices move too: check Gallabox's pricing page and your provider's live card before signing. This page describes mechanisms, not their latest numbers.

Which option fits which buyer: six honest verdicts

Each route fits a different buyer. Gallabox suits teams that need official status and a shared inbox. The Cloud API suits engineering teams that want no intermediary. Twilio suits multi-channel estates. Evolution API and WAHA suit developers who will build their own anti-ban layer. SocialMate suits senders who want a flat licence and local data.

Gallabox. For teams needing official status, template governance and a shared multi-agent inbox. Pricing is a subscription plus Meta's per-message charges passed through; verify the plan price on Gallabox's pricing page. Trade-off: cost per conversation is a variable you do not set, and contact identity is a record you do not own.

Meta Cloud API direct. For engineering teams that want no intermediary and will build against Meta's own docs. Pricing is Meta's rate card, per message by category. Trade-off: you own the integration surface, the template approvals and quality-rating management. In exchange you get the one thing self-hosting cannot offer — the official compliance envelope: approved templates, formal opt-in records and terms written for business messaging. Teams whose revenue depends on that envelope should buy it.

Twilio. For organisations already standardised on Twilio across channels. Pricing is Meta's rates plus a per-message Twilio fee; Twilio's WhatsApp pricing page lists the current figure, so verify it before modelling costs. Trade-off: one more margin layer between you and the rate card.

Evolution API. For developers who want open-source building blocks and will run them. Pricing is hosting plus your time. Trade-off: anti-ban logic, a GUI, message history and the care of the number are yours to assemble. Ban risk is real and non-zero.

WAHA (WhatsApp HTTP API). For teams that want a documented HTTP surface on their own host. Pricing is hosting plus your time. Trade-off: pacing, risk scoring and storage are largely your build. Ban risk is real and non-zero.

SocialMate. For founders, marketers, agencies and developers sending many individual, expected messages from their own number, who want a flat licence, local data and a native n8n node or local API. Pricing is $0 Free, or $99 a year ($8.25 a month equivalent) or $10 a month on Pro. Trade-off: unofficial route, bans remain possible, and you carry the care of your own number.

Deeper comparisons: vs the Cloud API, vs Evolution API, vs WAHA.

What is BSUID, and why does it only exist on the Cloud API side?

BSUID is a business-scoped user identifier — a handle for a contact scoped to a business rather than a raw phone number. It exists on Meta's Cloud API side because Meta issues and controls those identifiers. A self-hosted tool that keys contacts by phone number in a local table has no Meta-issued key to rename.

The migration burden follows from the schema. A platform that stores Meta-issued identifiers must map old to new, backfill history, keep webhooks and templates consistent, and retest edge cases under load when those identifiers change. Twilio's changelog, cited above, frames the field as required from June 2026 for Cloud API senders. Inbound-only teams face a narrower set of questions than senders, which is covered in WhatsApp BSUID migration for inbound-only teams.

A local table keyed by phone number does not move, so the migration does not exist. That is a claim about schema, not about security or compliance.

How does Meta's per-message pricing reach a Gallabox invoice?

A business solution provider's invoice usually has two parts: its own subscription and Meta's per-message charges passed through. When Meta reprices, the second part moves whether or not the provider ships anything. The customer sees a new number on a familiar bill, and the provider is transmitting a decision taken one layer beneath it.

The structure has already changed more than once. Gallabox's changelog entry dated 30 June 2025 records Meta's per-message pricing rollout, with utility messages free inside the customer service window. Twilio's Help Center notice, dated October 2026, is titled as changes to WhatsApp's pricing and relays the next change to its own customers. Both are a channel's account of Meta's structure, not a Meta announcement: read the effective dates and rates in the notice itself.

The practical consequence is that a line on your invoice can move for reasons unrelated to the provider's roadmap, headcount or support quality. That is not a criticism. It is what pass-through billing is for.

A flat licence works differently: it prices the software per device and lets the work run on your hardware. There is no per-message unit to pass through, so there is nothing for a rate card to reach. The arithmetic is in flat-rate service messages vs per-message fees.

Which layer of your WhatsApp stack can Meta reprice or rename?

A WhatsApp automation stack has four separable layers: the session, the identity, the meter and the store. Meta controls the first three on its own rails, and no provider can hand them over, because its compliance posture depends on holding them. Self-hosting puts the session and the store on your machine and removes the meter.

• Session. On the Cloud API the number is registered to Meta's platform through the provider, behind business verification and a dedicated-number requirement. Self-hosted, it is a QR pairing of a number you already own, held on your machine.
• Identity. Cloud API stacks key contacts by platform-issued identifiers, which is exactly where BSUID lands. A self-hosted app keys contacts by phone number in a local table.
• Meter. The Cloud API bills per message or conversation through Meta. A flat-licensed app bills a licence and nothing per send.
• Store. Vendor cloud versus your own local storage.

Be precise about what a provider like Gallabox actually owns: the inbox UX, template governance, agent tooling and analytics are its own software, and that is real work. What it does not own is the session, the identifier scheme or the meter — those are Meta's by contract.

BSUID lives in identity. Repricing lives in the meter. Neither reaches a stack that does not contain those objects.

Does self-hosting remove WhatsApp policy risk? No — here is what it does change

No. Self-hosting changes where your data lives and whether a per-message charge exists. It does not change WhatsApp's rules, its enforcement, or the fact that bans are possible on every route, official or unofficial. Automating a personal WhatsApp account can violate WhatsApp's Terms of Service, and consent remains your obligation on any route.

The Cloud API's compliance envelope is a genuine advantage a self-hosted tool does not have: approved templates, opt-in records, official status, and terms written for business messaging. If your revenue depends on that envelope, buy it.

What a self-hosted app can do is make sending behave like a person. The recommended first 72 hours run at Safe pacing: randomised delays and jitter, read receipts and a real typing indicator before each reply, an adaptive throttle that stretches gaps as the eight-factor risk score climbs, a duplicate-content guard that blocks identical text to many contacts, and risk-based auto-resume when a cooled account's score falls. Polls, locations and contact cards are not auto-queued when anti-ban blocks them: those sends return HTTP 429 with queueable:false on every tier. Text and URL media queue on Pro.

Those measures reduce risk. They do not eliminate it, and no vendor claiming otherwise is selling certainty it cannot deliver. Read Will I get banned? for the plain answer, and WhatsApp messaging limits in 2026 for how official tiers and quality ratings work.

What does a self-hosted alternative to Gallabox actually cost?

Free is $0 forever, no card, with 200 messages a day on one WhatsApp account. Pro is $99 a year ($8.25 a month equivalent) or $10 a month, cancel anytime, and there is no per-message fee of any kind. One licence includes one device; extra seats cost about $4 a month each on the monthly plan.

Pro sending starts at a deliberately safe 500 messages a day per account and, only after the 72-hour warming protocol, High-Volume Mode scales that to 5,000 a day per account. WhatsApp accounts are unlimited on Pro. The 7-day Pro trial is opt-in from inside the app and asks for an email, not a card.

Compare that with an invoice built from a subscription plus a metered line whose rate is set by Meta and relayed by your provider. The flat licence does not discount the meter. It removes it, because the work happens on hardware you own and there is no unit to count.

The local HTTP API runs on every tier, Free included: read endpoints, plain text send, quoted replies, reactions, mark-as-read and the typing indicator. Pro adds media, group operations, the smart queue, scheduled batches, Agent Memory and a stable named tunnel. None of it is metered. Current numbers are on the pricing page.

Can you move off Gallabox without losing conversations?

Yes, with caveats. Contacts, consent records and the number itself can move. A Cloud API transcript cannot be copied across wholesale. The sequence matters more than the tool: confirm the number is yours to release, export consent while you still have access, link by QR, warm at Safe pacing for 72 hours, then start with people already waiting on you.

1. Confirm the number is yours to keep. A number registered to Meta's platform through a provider may need to be released first. Ask before cancelling anything.
2. Export contacts and consent status while the account is live. Consent records travel with the list and matter more than the list.
3. Install SocialMate on the machine that will run it and link the account by QR code. No Meta business verification and no dedicated-number application.
4. Run the first 72 hours at Safe pacing. Warming is the prerequisite for higher limits, never an optional extra.
5. Turn on Pro auto-sync on connect, and note that backfill is a one-shot rebuild of the local archive that runs when you upgrade to Pro. Neither restores a Cloud API transcript wholesale.
6. Start one batch of people already waiting on you — they ordered, they booked, they asked. Never a purchased or guessed list.

Three honest limits. Cloud API history is not a file you copy. Identical text to many contacts is blocked by the duplicate-content guard, because that pattern is what gets numbers reported. And polls, locations and contact cards are not auto-queued when anti-ban blocks them — the queue cannot carry their payloads — so those sends return HTTP 429 with queueable:false on every tier.

Frequently asked questions about BSUID, Gallabox billing and self-hosting

The questions below recur on calls and in search: whether BSUID applies to you, whether Meta can reprice a licence, who owns the number, how real the ban risk is, and what the daily limits actually are. Each answer stands on its own.

If yours is not covered, the knowledge base covers warming, migration and operations, and /docs covers the local HTTP API, the n8n node and the MCP server.

Option	Pricing model	How contacts are keyed (identity)	Where the transcript lives	Ban / account risk	Best fit
Gallabox (built on the Cloud API)	Subscription plus Meta's per-message charges passed through by category; utility free inside the service window since Meta's 30 June 2025 rollout, per Gallabox's changelog. Verify the plan price on gallabox.com/pricing	Meta-issued identifiers on Meta's rails; BSUID lands here if the reported change ships (Twilio's changelog lists the field as required from June 2026, provider-reported)	Gallabox cloud	Official route. Risk appears as template rejection, quality-rating limits and per-message cost rather than protocol bans	Teams needing official status, template governance and a shared multi-agent inbox
Meta WhatsApp Cloud API (direct)	Meta's rate card: per message by category. Rates vary by market and category; use the dated rate card for your country	Meta-issued identifiers	Meta	Official route with the same template and quality constraints plus the compliance envelope	Engineering teams that want no intermediary and will own the integration
Twilio (CPaaS on the Cloud API)	Meta's rates plus a Twilio per-message fee; verify the current figure on Twilio's WhatsApp pricing page. Twilio's Help Center notice dated October 2026 covers the next change	Meta-issued identifiers	Twilio	Official route; risk sits in templates, opt-in records and spend	Teams already standardised on Twilio across channels
Evolution API (self-hosted, open source)	Open-source software you run yourself; you pay hosting and operations time	Phone number in your own database	Your database or Docker volume	Unofficial protocol: real, non-zero ban risk. Anti-ban logic, GUI and storage are yours to build	Developers who want to assemble their own stack
WAHA (WhatsApp HTTP API, self-hosted)	Open-source software you run yourself; hosting plus operations time	Phone number in your own database	Your Docker volume	Unofficial protocol: real, non-zero ban risk. Pacing and risk scoring are largely your build	Teams that want a documented HTTP surface on their own host
SocialMate (self-hosted, flat licence)	Flat licence, no per-message fee: Free $0 (200 msgs/day, 1 account); Pro $99/yr ($8.25/mo equivalent) or $10/mo (500/day, up to 5,000/day only after 72h warming)	Phone number in a local contact table	Local storage on your machine, or your VPS volume with optional per-account proxy	Unofficial protocol: real, non-zero ban risk. Warming, pacing, duplicate guard and live risk scoring reduce it; nothing eliminates it	Founders, agencies and developers sending many individual, expected messages

Move a WhatsApp number from a Cloud API provider to a self-hosted app

1. Confirm the number is yours to keep A number registered to Meta's platform through a provider may need to be released before it can be linked elsewhere. Ask the provider before cancelling anything.
2. Export contacts and consent status Download the contact list while you still have account access, and keep the record of who opted in and when. Consent records matter more than the list.
3. Install SocialMate and link the account Install on the machine that will run it, open the app, and link the number by QR code. No Meta Business verification and no dedicated-number application are involved.
4. Warm the number at Safe pacing Run the first 72 hours at Safe pacing with modest volume. The adaptive throttle stretches gaps as the risk score climbs, and warming is the prerequisite for higher limits.
5. Turn on Pro auto-sync Auto-sync on connect is a Pro feature. Backfill is an automatic, one-shot rebuild of the local archive when you upgrade to Pro. Neither restores a Cloud API transcript wholesale.
6. Start one batch of expected messages Begin with people already waiting on you: they ordered, booked or asked. Identical text to many contacts is blocked by the duplicate-content guard, so personalise each message.

Frequently asked questions

Is Gallabox affected by WhatsApp's BSUID change?

Gallabox builds on Meta's Cloud API, so it sits on the identity layer Meta controls. BSUID is a reported change to how WhatsApp keys users: Twilio's changelog lists the field as required starting June 2026, and no general date is confirmed publicly. If it ships as documented, Cloud API providers carry the migration for their customers. Ask Gallabox for its position and timeline.

Does the pricing change Twilio relayed in October 2026 affect SocialMate?

No. That change reprices Meta's per-message charges, which exist because the Cloud API meters sends on Meta's platform. SocialMate sends from your own number on your own machine, so there is no Meta billing line in the path for a rate card to reach. Licences are priced per device, not per message.

Can Meta reprice a SocialMate licence?

No. The licence is priced per device at $0, $10 a month or $99 a year, and there is no per-message component to reprice. Meta's rate card governs Cloud API messages. SocialMate does not send through that biller, so no Meta line appears in your costs.

Do I keep my WhatsApp number if I leave Gallabox?

Usually the number is yours, but confirm with Gallabox before cancelling, because a number registered to Meta's platform through a provider may need to be released first. Once released, you link it to SocialMate by QR code and warm it for 72 hours before raising volume.

Is self-hosting ban-proof?

No, and nothing is. Automating a personal WhatsApp account can violate WhatsApp's Terms of Service, and bans remain possible on every route, official or otherwise. SocialMate ships warming, pacing profiles, a duplicate-content guard and live risk scoring that reduce risk. They do not eliminate it, and high volume on a new number stays dangerous.

Is SocialMate affiliated with WhatsApp or Meta?

No. SocialMate is independent and not affiliated with, endorsed by, or partnered with WhatsApp or Meta; those names are used for identification only. It links your own number over the WhatsApp Web protocol rather than through the official Cloud API, and it is not the official WhatsApp Business API.

How many messages can I send per day?

Free allows 200 messages a day on one account. Pro starts at 500 a day per account and, only after the 72-hour warming protocol, High-Volume Mode scales to 5,000 a day per account. Warming is a prerequisite for the higher ceiling, never an optional extra, and no volume is risk-free.

Do I need Meta business verification to automate WhatsApp this way?

No. There is no Meta Business verification and no dedicated-number application, because you are not using the official Cloud API. You link a number you already own by QR code. That removes the approval gate and also removes the Cloud API's compliance envelope, which is a real trade-off, not a free win.

Can an agency run several client numbers this way?

Yes. Pro allows unlimited WhatsApp accounts, each with its own pacing, per-number rate limits and risk score. Seats are per concurrent device, about $4 a month each beyond the first on the monthly plan. On a VPS, Pro adds per-account proxy routing so an account can egress through a residential or mobile IP you supply.

What counts as a legitimate use of SocialMate?

Messages to people who are already waiting on you: they ordered, booked or asked, and they consented to hear from you. One batch means many individual, personalised messages, each paced by the anti-ban pipeline. Purchased, scraped or guessed lists are out of scope, and identical text to many contacts is blocked by the duplicate-content guard.