Security

Every conversation, kept private.

Your customers trust you with order numbers, addresses and phone calls. Here’s how we protect them — from the data center to the AI.

EU-hosted

Primary in Paris, backups in Frankfurt.

GDPR

DPA included on every plan.

SOC 2 Type II

Report available under NDA.

ISO 27001

Certified information security.

Practices

Secure by default.

Encryption

AES-256 at rest, TLS 1.3 in transit. Call recordings and attachments are encrypted with per-workspace keys.

Access control

SSO with SAML and SCIM provisioning, enforced two-factor login, and roles that limit who sees which inbox.

Audit log

Every sign-in, export, setting change and AI hand-off is logged and exportable to your SIEM.

Retention & deletion

Set retention per channel. Customer erasure requests delete a contact across every channel in one action.

Infrastructure

Isolated production network, least-privilege access for staff, and encrypted daily backups tested monthly.

Testing

Annual third-party penetration tests and a public bug bounty. Summaries shared with customers on request.

AI & your data

Your conversations never train shared models.

Zero retention at model providers

Prompts and replies are not stored or used for training.

PII redaction before inference

Card numbers, IBANs and IDs are masked before any model sees them.

Scoped knowledge

Each AI agent only reads the articles and tools you allow.

Answers you can audit

Every AI reply cites its source and is kept in the thread.

Subprocessors

Who handles your data.

Updated 1 Sep 2026 · 30 days’ notice before changes

Provider	Purpose	Location
Scaleway	Application hosting & databases	Paris, FR
Amazon Web Services	Encrypted backups	Frankfurt, DE
Meta Platforms	WhatsApp Business Platform	Dublin, IE
Twilio	Phone numbers & voice calls	Dublin, IE
Postmark	Transactional & inbound email	EU region
Stripe	Billing & payments	Dublin, IE