Security and privacy
Isolation between businesses
Every query in the system is scoped to your business, and an API key sees only that business too. A user of one business cannot see a conversation, lead or setting of another. The agency owner sees everything β that is their job.
Access
- Passwords are stored as hashes (bcrypt); common passwords are rejected. Five wrong sign-in attempts β a 15-minute lockout.
- Sign-in cookies are HttpOnly + SameSite, encrypted over HTTPS. Disabling a user or resetting a password signs them out of every device.
- CSRF protection on every action; email tokens (verification, reset, invitation) are single-use and time-limited; API keys are stored as hashes only.
Messages and calls
- Messages from Meta are verified by signature; voice events β by a secret dedicated to the business; payments β by Stripe's signature. Webhooks we send are HMAC-signed.
- Credit card and ID numbers are masked before saving. Amounts on payment receipts are hidden from the AI.
- Conversation content is processed by an Anthropic model through the commercial API, which is not used to train the model.
- Links customers send are read on the server with SSRF protection β they never reach the internal network.
Retention and erasure
- The operational log files contain no numbers, emails, addresses or content β only event codes.
- Conversation content is purged automatically after the retention period; a customer can request immediate erasure; the business can export everything and request account deletion. Details β
- Consents and opt-outs are stored with evidence β so you can prove you honoured every request.
A question about data processing, a DPA or server location? Talk to us.