how heysteff protects your customers' data.

All traffic between your team, your customers and heysteff's servers travels encrypted. That's the minimum expected standard for any software handling real conversations, and we meet it with no exceptions for any channel.

Where many platforms fall short is encryption at rest, meaning how sensitive data is stored once it has reached the server. The credentials that connect your workspace to WhatsApp, Instagram, Gmail or Shopify — access tokens, API keys — are stored encrypted with AES-256-GCM, a symmetric encryption standard used across the industry to protect data at rest. They don't sit as plain text in any table or configuration file: if someone accessed the database directly, they couldn't read those credentials without the encryption key, which is managed separately.

heysteff is a multi-tenant platform: many different brands share the same infrastructure, each in its own workspace. The classic risk of any multi-tenant SaaS is that a programming error — a poorly filtered query, a bug in an endpoint — ends up showing one customer's data to another.

That's why isolation in heysteff doesn't rely only on the application code "remembering" to filter by workspace in every query. It's also enforced at the database level with Row-Level Security (RLS): every table that stores customer data has a rule the database itself applies on every query, no matter which part of the code is running it. It's an additional security layer, not the only one. If you're interested in the technical details, we explain them in our article on multi-tenancy and Row-Level Security.

Your workspace's conversations are used for one thing only: so that Steff serves your customers better, inside your account. They're not used to train global language models and they're not shared across different customers' workspaces. Each business trains its own agent with its own knowledge base, and that base doesn't leak into another workspace or to the AI model provider as future training material.

You decide how long your conversation data is kept, and you can request full deletion of your data whenever you need it. The process is documented on our data deletion page, with the exact steps to request it. It's not a form buried in a menu: it's an explicit, accessible commitment.

Let's be honest about what this means: heysteff applies best practices aligned with the European General Data Protection Regulation (GDPR) and with Chile's personal data protection law — data minimization, encryption, access control, right to deletion — not a formal certification audited by third parties. If your business needs that level of audited certification for a specific procurement process, let's talk directly and review what applies to your case; we'd rather be clear about where we stand than overpromise.

The full detail of our security practices — encryption, infrastructure, responsible vulnerability disclosure — is on the heysteff security page.

• Multi-tenancy with Row-Level Security: why it matters for your privacy
• Uptime and transparency: how to read our status page
• Security at heysteff
• Data deletion