Security by Design, Privacy by Default
We hold our platform to the highest enterprise standards. Your data is isolated, fully encrypted, continuously monitored, and never used to train public machine learning models.
Encryption
All data encrypted in transit with TLS 1.2+ and at rest. No unencrypted data leaves our systems.
- ✓ End-to-end TLS 1.2 and TLS 1.3 encryption across all public and internal endpoints.
- ✓ AES-256 standard encryption for all database records, embeddings, and uploaded files at rest.
Access Controls
Role-based permissions for team members. Control who can access chatbot settings, training data, and conversation history.
- ✓ Strict multi-tenant database scoping guarantees isolation between client workspaces.
- ✓ Granular role controls ensuring client admins and agents only access authorized chatbot records.
Infrastructure
Deployed on Cloudflare Workers at the edge for low latency and high availability. Database access managed through Prisma Accelerate and hardened connection pooling.
- ✓ Distributed edge CDN delivering sub-100ms response times globally with 99.9% uptime.
- ✓ Enterprise DDoS protection and intelligent Web Application Firewall (WAF) filtering.
Vendor Management
All subprocessors are vetted and documented. Full subprocessor list published at /legal/subprocessors.
- ✓ Formal vendor risk assessment, annual security audits, and PCI-DSS / SOC 2 verification.
- ✓ Binding zero-data-retention agreements with AI LLM infrastructure partners.
Data Processing
Data Processing Agreement available for Enterprise customers for GDPR compliance.
- ✓ Standard Contractual Clauses (SCC) supporting GDPR, HIPAA, and global privacy mandates.
- ✓ Strict guarantee: Your uploaded documents and customer conversations are NEVER used to train baseline AI models.
Monitoring
Continuous monitoring of infrastructure and application security. Automated alerting for anomalous activity.
- ✓ Real-time intrusion detection, rate-limiting triggers, and automated anomaly flagging.
- ✓ Prompt injection safety barriers and Server-Side Request Forgery (SSRF) web crawler filters.
Need a custom Security Review or Signed DPA?
Our compliance team works directly with enterprise security and legal officers to complete custom vendor security assessments, sign DPAs, and provision private dedicated infrastructure.