Security and privacy
Your customers' data, handled the way a contact centre should.
This page is written for your IT and security team. It explains where data lives, who can see it, how the AI is kept inside your rules, and what happens if something goes wrong. We're happy to answer your security questionnaire too.
Your data stays yours
- Separate for each clientEvery request is checked on our server against the signed-in person and their company. A client's team can only ever see that client's conversations, knowledge and reports.
- RolesMain user, admin, supervisor, agent and viewer. Each person sees only what their role allows, and the main user manages who has access.
- Never used for trainingConversations are sent to our AI provider through its commercial service, which does not use them to train models. We don't sell data or use it for advertising.
- Where it's storedIn a managed database and file storage in the region agreed in your contract. Data is encrypted in transit and at rest.
Access and accounts
- Two-step loginAdmin accounts must use an authenticator app. Any user can turn it on from their account page.
- Keys to your systemsPasswords and API keys for your order, CRM or help desk systems are encrypted with AES-256 before they're saved, shown masked in the console and never shown to the AI.
- API keys and webhooksAPI keys are stored only as a one-way hash and can be replaced at any time. Every webhook we send is signed, so your system can check it really came from us.
- Abuse protectionRate limits on every public address, and daily allowances on the website chat.
Personal data in conversations
- MaskingCard numbers, bank account numbers (IBAN) and long ID numbers can be hidden before a conversation is stored. The agent never asks for card numbers, PINs, passwords or one-time codes.
- RetentionEach client chooses how long conversations are kept, from 30 days to one year. Older conversations are deleted automatically every night.
- Your customers' rightsWe help you answer access, correction and deletion requests from your customers.
An AI that stays inside your rules
- Answers only from your contentThe agent answers from your knowledge base. When it doesn't know, it says so and records the gap instead of guessing.
- Rules checked by codeRefund, cancellation and verification rules are checked by our system before any action, the same in every language. The AI explains the result but can't override it.
- Confirmed changes onlyA change in your system only counts as done when your system confirms it. Actions you choose can wait for a person's approval.
- Every conversation checkedQuality of service is scored on every conversation, with the exact words quoted as evidence.
Monitoring, backups and incidents
- Audit logEvery settings change is recorded with who made it and when.
- BackupsData is backed up every night, in addition to the database provider's own daily backups.
- MonitoringErrors and expiring channel connections alert our team automatically.
- If something goes wrongWe notify affected clients without undue delay with what happened, what data was involved and what we're doing, so you can meet your own reporting duties.
Laws and agreements
- Egypt and Saudi ArabiaWe process personal data in line with Egypt's Personal Data Protection Law No. 151 of 2020 and Saudi Arabia's Personal Data Protection Law, including their rules on cross-border transfers.
- Data processing agreementEvery client gets a data processing agreement that lists our sub-processors. Read it.
- PoliciesPrivacy policy and terms of service.
Have a security questionnaire?
Send it to us and we'll answer it, or let's walk your IT team through the setup.