Security

Built to be
trustworthy.

An AI platform processes your customers' messages. That's a position of trust — and we take it seriously. Here's exactly how the system is designed to protect your data and theirs.

Ask a Security Question Read the Privacy Policy
Multi-tenant isolation Cloudflare TLS + DDoS Secrets never in bundle Prompt injection defences Upload content scanning SSRF protection

A layered defence

Security in concentric rings — each one assumes the outer one will sometimes be bypassed.

1
Network perimeter
Cloudflare handles TLS termination, caching, and DDoS mitigation. All connections are encrypted in transit. No plaintext paths.
2
Application layer
Tenant ID is always derived from the authenticated JWT — never from the request body or a custom header. Webhooks fail closed if the secret is missing. Uploads are parsed in an isolated worker thread.
3
Data layer
Row-level security enforced at the database. Knowledge-base retrieval functions are restricted to the calling tenant's chunks and explicitly revoked from anonymous roles.
4
AI & retrieval layer
Untrusted content — uploaded documents, crawled pages — is fenced inside marked boundaries the content cannot close. A passage that looks like a prompt injection attempt downgrades the answer to cautious mode rather than following it.

What happens to data coming in

Every inbound path — message webhooks, uploads, crawls — is treated with suspicion by default.

Webhooks fail closed
Inbound messaging webhooks require a secret. If the secret is not configured or mismatches, the endpoint refuses every request — a misconfiguration fails safe, not permissive.
Uploads judged by content
Documents are checked against their actual file signature, not the extension they claim. PDFs with active content, DOCX macros, archive bombs and EICAR signatures are rejected. Parsing happens in an isolated process with a memory ceiling and a deadline.
Crawled content treated as untrusted
Text from a crawled website is passed to the AI as quoted material inside a marked boundary the content cannot close. Instructions found inside a document cannot change the agent's role or rules.
Server-side fetches restricted
The crawler validates the destination at connection time — not only before the request — closing the window a DNS-rebinding attack relies on. Redirects are re-checked hop by hop. Loopback, private and link-local addresses are refused.

Security notes per product

Each surface has its own isolation model.

Live Inbox
Channel credentials (WhatsApp, Instagram, Telegram tokens) are encrypted at rest and scoped to the connecting tenant only. Agent access is role-based — a teammate only sees the inboxes assigned to them.
Scheduler
Social account connections use OAuth tokens stored encrypted, never a shared password. Revoking access from the platform side (Meta, TikTok, LinkedIn) immediately breaks the connection on our end too.
Engage
Automations run through official platform messaging APIs and respect each platform's rate and consent rules — flows stay compliant with Meta and TikTok policy rather than relying on unofficial scraping.

How to report a vulnerability

We welcome responsible security research.

Email [email protected]. Include what you found, how to reproduce it, and what you think the impact is. If the issue could expose customer data, say so in the subject line and it will be treated as urgent.

Please test only against your own account, and do not access, modify or retain another customer's data in the course of research. We will confirm receipt, keep you updated on the fix, and credit you publicly if you would like to be credited.

1 Email [email protected]
2 Receive confirmation
3 Fix shipped, you're credited

Want the details before you commit?

If your process requires a security questionnaire, a data processing agreement, or the current subprocessor list before you can proceed, email us and we will work through it with you.

Ask a Security Question Read the Privacy Policy