Security & trust
Built to keep your conversations yours.
No security certifications to wave around yet. We're a small, focused team. What we can tell you is exactly how the product is built, plainly, without marketing gloss.
How we protect your data
Encrypted passwords
Passwords are hashed with Argon2 before they ever touch the database. We can't read your password, and neither could an attacker who accessed our database.
Scoped API keys
Every API key is limited to specific permissions you choose, and can be revoked instantly from your dashboard at any time.
CSRF & session protection
Dashboard sessions use httpOnly cookies with double-submit CSRF protection on every state-changing request.
Locked-down admin access
Platform-admin access is a database-level flag no UI can grant, and it's completely unreachable through the API, only a real dashboard session can use it.
Secure headers by default
Every response carries hardened security headers (HSTS, frame protection, content-type sniffing prevention) via Helmet.
Reputable infrastructure
Data lives in managed PostgreSQL; file uploads are stored on Cloudflare R2, encrypted at rest by the provider.
Payments
We never see your card details.
Billing runs through Stripe. Card numbers are entered directly into Stripe's own hosted checkout form. They never pass through our servers, so we never store or have access to full card details.
Your data, your account
Multi-tenant, by design.
Every website, conversation, and team member belongs to your workspace and only your workspace. That isolation is enforced at the database query layer on every request and is covered by an automated test suite that specifically checks one account can never read another's data. We run it before every release. Want your data removed entirely? Contact us and we'll delete it.
Common questions
What buyers usually ask.
Where is my data stored?
Account, workspace, and conversation data lives in a managed PostgreSQL database. File attachments are stored on Cloudflare R2, encrypted at rest by Cloudflare.
Do you have SOC 2, ISO 27001, or similar certification?
Not yet. We're a small, focused team without a formal certification. If that's a hard requirement for your organization today, contact us and we'll tell you plainly where things stand rather than pointing you at a canned document.
What happens to my data if I stop paying or cancel?
Nothing is deleted automatically. Your workspace simply pauses until you resubscribe. If you want your data removed entirely, contact us and we'll delete it within 30 days, as described in our Privacy Policy.
Can you fill out our security questionnaire?
Yes, email us the questionnaire and we'll answer it directly. We'd rather give you an accurate, specific answer than a generic compliance document.
Questions about how we handle your data?
We're happy to answer specifics, reach out anytime.
Contact us