Security
Built like your store depends on it. Because it does.
The same security principles that ship banking software, applied to a live chat widget. Real ones, not just badges.
Encryption everywhere
TLS 1.2+ in transit. AES-256 at rest. Passwords are hashed with bcrypt + per-user salt.
Least-privilege access
Production access is limited to on-call engineers. Audit-logged, MFA-required, time-bound.
Region-locked storage
Data lives in the region you choose (Sydney by default). EU + US data residency on Enterprise.
Independent testing
Annual third-party penetration test. Continuous Dependabot + Snyk on every PR.
Daily encrypted backups
Point-in-time recovery for the last 7 days. Cross-region restore capability tested quarterly.
SOC 2 in progress
Type II audit underway. ISO 27001 follows. Status updated transparently here.
Responsible disclosure
Found a security issue? Email [email protected] with details and we'll respond within 24 hours. We don't pursue good-faith researchers, and we publicly credit you (with your permission) once a fix ships.
For sensitive disclosures, use our PGP key fingerprint: XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX.
Compliance + certifications
- GDPR — compliant. EU-based merchants get a DPA on request.
- CCPA — compliant.
- Australian Privacy Act — compliant.
- SOC 2 Type II — audit in progress, expected Q3.
- ISO 27001 — on roadmap.
- PCI-DSS — we never touch card numbers; payments handled by Stripe (Level 1).
What we don't do
- We don't train AI models on your or your visitors' conversations.
- We don't sell or share data with advertisers.
- We don't lock you in. Full data export is one click from the dashboard.
- We don't use ad-tech tracking cookies anywhere on this site.