Skip to content
Security

Security and data protection

Your customers send you order numbers, addresses and complaints. This page says what happens to that data, what we can evidence today, and what we cannot yet.

What is in place today

  • Encrypted in transit and at rest

    Traffic to the workspace and the stored conversation data are both encrypted. For the exact cipher suites and hosting region, ask and we will confirm them in writing.

  • Role-based access

    Agent, supervisor and admin roles, with visibility set per channel. Seats cost nothing, so nobody on your team has a reason to share a login.

  • Official channel APIs only

    Every integration authorises through the platform’s own login flow. Tokens are scoped to what an inbox needs, and you can revoke them from the channel itself at any time.

  • Export and deletion on demand

    Contacts and conversation history export from the dashboard. Ask for deletion and we delete, then confirm back to you what was removed.

What the AI actually sees

This is the part buyers press hardest on, so the short version first: generation runs on a third-party model provider, and it only ever runs on a request you trigger.

  • With the AI agent switched off, no conversation content is sent to a model provider at all. Nothing runs in the background.

  • A generation sends the thread being answered plus the FAQ and catalogue you attached to the agent. Not your contact database, and not your other channels.

  • The model provider is a contracted processor like any other. Ask for the sub-processor list and you get names, not categories.

  • Every generation is metered against the credit that paid for it, so there is a record of what ran and when.

Certifications, honestly

We do not hold SOC 2 or ISO 27001 today. We would rather say that on a public page than have you find it out three weeks into a procurement review. Here is what we can put in your hands right now.

  • Data processing agreement

    Our current DPA, sent on request and signable before you migrate anything into the workspace.

  • Sub-processor list

    Who we use for hosting, AI generation, email delivery and error monitoring, and what each of them touches.

  • Security questionnaire

    Send us yours and we will complete it. Where the honest answer is “not yet”, it will say “not yet”.

  • Architecture walkthrough

    A call with someone who built it, for teams that need to follow the data path before they sign anything.

Doing a security review?

Tell us which of these your process needs and roughly when. A person answers, not a form.

Request these documents

Availability

The free platform is provided as is, with no uptime guarantee. That is the same wording as our terms rather than a softer version of it. Uptime commitments and the remedies attached to them exist on Custom plans and are set out in the order form.

Found something? Tell us.

Send steps to reproduce to the address below. We acknowledge every report by the next business day and tell you what we found. We will not threaten a researcher who reports in good faith.

Report a vulnerability

support@salecleverly.com