Your customers trust you with their messages. We treat them that way.
- Two-step verification
- Encrypted keys and tokens
- Signed webhooks
- Not used for AI training
Your account
Who can sign in, and what they can touch.
Two-step verification
Protect logins with an authenticator app, with recovery codes if you lose your phone.
Hashed passwords
Passwords are stored as bcrypt hashes. We can't read them, and neither can our team.
Sign out other devices
End every other session in one click; changing your password does the same.
Team roles
Admins manage agents and settings; support teammates answer chats without touching configuration. Owners keep billing, members and API keys.
Your data and connections
How your content and credentials are kept.
Encrypted connections
The dashboard, the chat widget and our API are served only over HTTPS.
Encrypted keys and tokens
Integration keys, channel tokens, helpdesk credentials, email passwords and your own AI key are encrypted before they're stored, and never shown again.
Separate workspaces
Each business's agents, knowledge and conversations live in its own workspace. Agency clients never see each other.
Your data isn't training data
We don't use your content or your customers' conversations to train AI models.
Your customers
What the agent will and won't do in a chat.
Verified identity
Sign logged-in customers in with a JWT from your server. Actions only use verified details, never what someone typed.
Safe actions
Order and billing actions for verified customers only, with confirmation, optional team approval and a limit on runs per chat.
Guardrails
AI spam detection, per-visitor rate limits, blocked countries, blocklists and allowed domains for the chat bubble.
Tested in a sandbox
Agent tests never run real changes, emails or webhooks.
Your systems
Everything that talks to your stack.
Signed webhooks
Every event we send to your systems carries an HMAC-SHA256 signature so you can confirm it came from us.
Verified inbound requests
Slack requests are checked against your signing secret, and WhatsApp webhooks against your app secret when you add it.
Revocable API keys
Create a key per integration and revoke it the moment it's no longer needed.
Delete any time
Delete conversations, contacts, sources or a whole agent from the dashboard. Disconnecting Facebook or Instagram removes its access token immediately.
Found a security issue?
Tell us privately and we'll respond quickly. Please give us a chance to fix it before sharing it publicly.
Reach us through the contact page.
Read how we handle personal data in our privacy policy and DPA.