07 / security

your data, at rest.

We treat every conversation like it's our own. Here's the exact list of how we protect it.

◆ summary

Encryption in transit & at rest, least privilege, workspace isolation, no training of global models on your data, daily backups. Reports & questions: [email protected].

Encryption

  • In transit: TLS 1.2+ everywhere. No exceptions for internal channels.
  • At rest: AES-256 for Postgres and disk storage. Keys rotated quarterly.
  • Secrets: never in code or repos. Managed by a dedicated secret manager.

Data and models

  • Your data is never used to train global models. Period.
  • Conversations are isolated per workspace. No customer can see another's data.
  • We process model calls via AI providers with zero-data-retention commitments or equivalents.
  • You can request a full export or deletion in under 30 days.

Infrastructure

  • Servers in regions you choose (default: South America / North America).
  • Automated backups every 24h. Minimum 30-day retention.
  • Admin access only with 2FA + audited per-person authorization.
  • 24/7 monitoring. Real-time anomaly alerts.

Compliance

  • Chilean Law 19.628 (personal data protection).
  • GDPR best practices for EU customers.
  • Aligned with WhatsApp Business & Meta Platforms official policies.
  • SOC 2 Type I in progress (target: late 2026).

Responsible disclosure

Found a security issue? Email [email protected]. We answer within 48 hours and credit researchers who help us.