Our approach
We keep the amount of data we hold small, protect what we do hold at every step, and make it easy for you to see and delete it. We would rather tell you about a limitation than hide it.
Protecting data
- Every connection to the dashboard, the widget and our API is encrypted with HTTPS (TLS 1.2 or newer).
- Secrets you give us, such as channel tokens, CRM keys and MCP credentials, are stored encrypted.
- Each customer’s data is separated in our application, and every request checks that you own what you are asking for.
- You choose how long conversations are kept, and you can export or delete any person’s data from the dashboard.
Accounts and access
- Two-factor authentication with any authenticator app, which administrators can make mandatory.
- Login protection: repeated wrong passwords lock the account temporarily, and repeated attacks get the IP address blocked across the service.
- Team roles, including custom roles, so each person only sees what they need.
- An audit log records important actions such as plan changes, data exports and settings changes.
Application security
- Protection against common web attacks (cross-site scripting, request forgery, SQL injection, clickjacking) is built into every page.
- Webhooks we receive from Stripe, PayPal, WhatsApp, Slack, Discord, Twilio and others are checked against their signatures; anything unsigned is rejected. Webhooks we send are signed so you can verify them.
- When the assistant fetches web pages or calls tools for you, private and internal network addresses are blocked to prevent server-side request forgery.
- Known scanning tools are blocked automatically, and security events are reviewed.
AI safety
The assistant only answers from your knowledge and instructions, tells visitors when it is unsure, and can hand over to a person. Conversation content is sent to AI providers through their business APIs, which do not train on that data by default. More detail on our AI transparency page.
Monitoring and backups
We monitor errors, AI provider failures and unusual activity, and an automatic backup provider takes over if the main AI provider fails. The database is backed up regularly and backups are encrypted and kept for a limited time.
What you can do
- Turn on two-factor authentication for everyone on your team.
- Give team members the smallest role that lets them do their job, and remove people who leave.
- Keep the AI notice and human handoff switched on, and check the “questions it could not answer” list regularly.
- Rotate any channel or CRM token you think may have leaked.
Reporting a vulnerability
If you believe you have found a security problem, email [email protected] with the steps to reproduce it. We will reply within three working days, keep you updated, and will not take legal action against good-faith research that respects people’s privacy, avoids damage and gives us reasonable time to fix the issue before it is made public.