Honest about what we do and what we don't.
We're a small team building for SMBs. We don't have enterprise certifications yet. Here's exactly what we do have, what we're working on, and what's not built yet.
Security we've actually built.
These are features in the codebase today, not planned items on a roadmap.
Every database table has a tenant_id column. Every query filters on it. One customer cannot see another customer's data — enforced at the database layer, not just the API layer.
All traffic runs through Caddy with auto-provisioned TLS certificates. API calls, webhook deliveries, widget connections — everything is HTTPS.
Channel credentials (WhatsApp tokens, Telegram bot tokens) are encrypted with Fernet symmetric encryption before storage. We never store plaintext secrets.
WhatsApp webhooks verified via HMAC-SHA256 (X-Hub-Signature-256). Telegram webhooks verified via constant-time secret comparison. Spoofed webhooks are rejected.
Widget API keys are scoped to specific domains. A key configured for example.com won't work on attacker.com. Keys without domains are playground-only.
Dashboard passwords are bcrypt-hashed. We never store or log plaintext passwords. Login endpoints are rate-limited (10 attempts per 5 minutes per IP+email).
Redis sliding-window rate limiting per API key (RPM/RPS from plan), per IP (120/min on widget endpoints), and per-tenant monthly conversation + token quotas.
Your conversations and knowledge base are never used to train any AI model. We use commercial LLM APIs (OpenAI, xAI, Anthropic) which also don't train on API inputs.
How your data is handled.
Customer messages flow through our API, get processed by the LLM for a response, and are stored in our database. Stateless application services mean no data lives in memory between requests — everything persists in the database or expires automatically.
Knowledge base documents are chunked, embedded, and indexed for hybrid retrieval (keyword + semantic search). Session memory expires after 7 days. Conversation summaries are stored alongside the conversation for continuity.
The marketing site is served from Cloudflare's global edge network, completely separated from the application infrastructure. No customer data touches the marketing site.
Honest gaps.
We'd rather tell you upfront than have you find out later.
We don't have SOC 2 or ISO 27001. We follow the principles (access control, encryption, logging) but haven't gone through formal audits. These are on the roadmap as we grow.
Dashboard login is email + password only. SAML, OIDC, and SCIM provisioning are not built yet. Enterprise customers needing SSO should talk to us about timeline.
We don't yet offer region-specific data hosting. If you have strict data residency requirements (EU-only, SG-only), talk to us — it's on our roadmap.
We haven't had an external penetration test yet. We follow OWASP top 10 practices and do internal security reviews, but don't have a third-party report to share.
GDPR and PDPA alignment.
We're aligned with GDPR (EU) and PDPA (Malaysia) principles:
- Data minimisation — we only collect what's needed for the conversation to work.
- Purpose limitation — customer data is used to power the agent, not for ads or model training.
- Right to delete — accounts can be fully deleted. Conversation data is purged within 90 days of account closure. Session memory expires automatically (7-day TTL).
- Sub-processor transparency — we use OpenAI/xAI/Anthropic for LLM inference, Hetzner for hosting, Cloudflare for the marketing site. No hidden data sharing.
- DPA available — we provide a standard Data Processing Agreement on request. Email [email protected].
We don't claim GDPR “certification” (there is no such thing). We align with the regulation's principles and provide the contractual instruments (DPA) that businesses need.
How we operate.
Security incidents are acknowledged within 4 hours during business hours (GMT+8). Critical vulnerabilities (data exposure, authentication bypass) are patched within 72 hours. Affected customers are notified via email within 24 hours of confirmation.
Active accounts: data retained for the life of the subscription. Session memory (Redis): 7-day auto-expiry. Closed accounts: all data deleted within 90 days. Conversation exports available before deletion. Backups retained for 30 days, then purged.
Infrastructure access is limited to the founding team via SSH key authentication (no password login). Database access requires SSH tunnel — no public endpoint. Dashboard admin access is gated by a server-side email allowlist. All admin actions are logged.
Every admin API call is logged with timestamp, user, action, and affected resource. Webhook deliveries are recorded with request/response bodies and timing. LLM usage is tracked per-call with cost, latency, and model. All logs are retained for 90 days.
Code deploys automatically on every push to main via GitHub Actions. No manual SSH access needed for routine deploys. Database migrations run automatically before container restart. Rollback via git revert.
PostgreSQL: daily automated pg_dump backups retained for 30 days. Redis: persistence enabled with AOF logging. Backups stored on the same datacenter (Hetzner Falkenstein) — offsite backup is on the roadmap.
Found a vulnerability?
Email [email protected] with details. We acknowledge within 48 hours and aim to patch critical issues within 72 hours. We don't have a formal bug bounty program yet, but we'll credit you publicly (with your permission) and are happy to discuss recognition.
Also see: Privacy Policy · WhatsApp Data Handling · DPA
Questions about security?
Email [email protected]. We respond within 48 hours with real answers, not canned responses.