Security

Your customers trust you with their conversations, and you trust us to keep that data safe. Here is how we do it.

Infrastructure

Data is protected both on the wire and on disk. Every connection between your browser and our servers uses TLS 1.3, the latest transport encryption standard. Data stored in our database is encrypted with AES-256, one of the strongest ciphers available.

Our application runs on infrastructure that has passed SOC 2 compliance audits, meaning an independent assessor has verified the security controls are in place. We take automated backups and store copies in separate geographic regions, so your data is recoverable even if an entire data center goes offline.

We also run protection against distributed denial-of-service (DDoS) attacks and enforce rate limits to stop abusive traffic before it reaches the application.

Application Security

We follow a defence-in-depth approach. Every response from our servers includes security headers — Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), and X-Frame-Options — which tell browsers to block common attack vectors like code injection and clickjacking.

All user input is validated before it enters our system, and all output is encoded before it reaches the page. This prevents SQL injection (where an attacker tries to manipulate database queries) and cross-site scripting, or XSS (where an attacker tries to run code in another user's browser).

We scan every software dependency for known vulnerabilities on a regular schedule and patch promptly when issues are found.

Access Control

Inside Chattering, access is role-based. Each teammate in your workspace sees only what their role allows — an agent can reply to conversations, while only an admin can change billing or security settings.

Passwords are hashed with bcrypt, a deliberately slow algorithm that makes brute-force attacks impractical. Sessions are managed with secure, signed tokens that expire automatically. Two-factor authentication is available for teams that want an extra layer of login security.

Data Protection

We collect only the data we need to run the product. We don't mine your conversations for advertising or sell data to third parties.

Our retention policies are enforced automatically: when data is no longer needed, it gets deleted. If you ask us to delete your data, we do it promptly — that's your right under the General Data Protection Regulation (GDPR) in Europe and the California Consumer Privacy Act (CCPA) in the United States, and we honour it everywhere.

Incident Response

We have a written incident response plan that the team rehearses. If we confirm a data breach, we notify affected users within 72 hours, as GDPR requires. The notification includes what happened, what data was involved, and what we're doing to fix it.

Responsible Disclosure

If you find a security vulnerability in Chattering, please let us know at support@chattering.ai. We take every report seriously, investigate promptly, and will not take legal action against researchers who follow responsible disclosure practices.