Security

Tenant isolation

• The platform is multi-tenant: Organization → Workspace → resources. Every database query is scoped server-side by the active organization and workspace resolved from the authenticated session, never from browser input.
• Role-based access control (owner/admin/supervisor/agent/viewer plus an optional platform-admin role outside tenant space) is enforced on every API route before any data access.

Authentication

• Passwords are bcrypt-hashed; login session tokens are random and stored only as SHA-256 hashes inside httpOnly, secure cookies.
• Two-factor authentication using TOTP plus email-based one-time codes, with single-use recovery codes.
• Magic-link login, email verification, password reset and SAML 2.0 SSO (Okta/Google Workspace/Entra) per organization, where enabled by plan.
• Optional Google / GitHub OAuth with state verification and JIT provisioning.
• Login and sensitive endpoints are protected by fixed-window rate limiting.

Encryption and secrets

• Channel secrets (WhatsApp, SMTP/IMAP, Telegram, LINE, Twilio, Slack, webhook signing), 2FA TOTP secrets, OAuth tokens and API keys are encrypted at rest with AES-256-GCM using per-record IVs and auth tags.
• HTTPS everywhere in production; strict Content-Security-Policy with per-request nonces (no unsafe-inline scripts), strict frame-ancestor rules, and hardened form-action for the checkout flow.

Platform hardening and operations

• Structured JSON logs with x-request-id propagation for fast incident forensics; opt-in OpenTelemetry tracing.
• Nightly encrypted database backups with a documented restore runbook.
• Automated failure and failover handling for database outages.
• GitHub Actions CI running typecheck, lint, and a growing unit-test suite (750+ tests) plus a Playwright end-to-end suite covering visitor-to-agent flows.

Governance

• Audit events are written for security-relevant mutations (permissions changes, credential updates, campaign & integration config, impersonation, retention purges) and viewable in-app with filters and export.
• Data-retention policies can be set per organization; an automated sweep purges conversations, messages, and attachments past the configured threshold.
• Super-admin access is accounted for: impersonation always stamps an amber banner and a separate audit trail.

Responsible disclosure

We welcome reports of security issues. If you discover a vulnerability, please do not test it against production data or make it public before we've had a chance to fix it.

Send details (steps to reproduce, impact assessment, and any proof-of-concept) through the address on our Contact page. We respond to initial reports within 2 business days and keep reporters informed of progress.

Backup and continuity

Beyond nightly database backups, the deployment includes scheduled jobs for webhook redelivery retries, campaign and scheduled-message dispatch, retention enforcement, and background report digest — all built with retry and idempotency guarantees.