Security

Your customers trust you with their conversations, and you trust us to keep that data safe. Here is how we do it.

Certifications and compliance

We are not SOC 2, ISO 27001 or HIPAA certified, and we do not claim to be. Chattering is a young product and those audits are a real, multi-month commitment we have not yet made. If your procurement process requires a current SOC 2 Type II report or a signed BAA, we are not the right fit today, and we would rather tell you that in the first five minutes than in week six.

What we can give you right now: this page, which lists every control actually in place rather than the ones that sound good; a Data Processing Agreement covering GDPR processor obligations; EU data residency on the Enterprise plan; and a straight answer to any security questionnaire you send to support@chattering.ai. We will fill one in honestly, including the rows where the answer is “not yet”.

SOC 2 Type II is on the roadmap and is not scheduled. When it starts, it will appear on the changelog like everything else, with a date rather than a promise.

Infrastructure

Data is protected both on the wire and on disk. Every connection between your browser and our servers uses TLS 1.3, the latest transport encryption standard. Data stored in our database is encrypted with AES-256, one of the strongest ciphers available.

Our servers run in Hetzner data centres in Germany and Finland. Hetzner operates an information security management system certified to ISO/IEC 27001:2022 across all of its hosting services and data centres. That is their certification, not ours — it says the building and the platform were independently assessed, not our application. We take automated nightly backups and store copies in two other locations, so your data survives the loss of the machine it runs on.

We also run protection against distributed denial-of-service (DDoS) attacks and enforce rate limits to stop abusive traffic before it reaches the application.

Application Security

We follow a defence-in-depth approach. Every response from our servers includes security headers — Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), and X-Frame-Options — which tell browsers to block common attack vectors like code injection and clickjacking.

All user input is validated before it enters our system, and all output is encoded before it reaches the page. This prevents SQL injection (where an attacker tries to manipulate database queries) and cross-site scripting, or XSS (where an attacker tries to run code in another user's browser).

We scan every software dependency for known vulnerabilities on a regular schedule and patch promptly when issues are found.

Access Control

Inside Chattering, access is role-based. Each teammate in your workspace sees only what their role allows — an agent can reply to conversations, while only an admin can change billing or security settings.

Passwords are hashed with bcrypt, a deliberately slow algorithm that makes brute-force attacks impractical. Sessions are managed with secure, signed tokens that expire automatically. Two-factor authentication is available for teams that want an extra layer of login security.

Data Protection

We collect only the data we need to run the product. We don't mine your conversations for advertising or sell data to third parties.

Our retention policies are enforced automatically: when data is no longer needed, it gets deleted. If you ask us to delete your data, we do it promptly — that's your right under the General Data Protection Regulation (GDPR) in Europe and the California Consumer Privacy Act (CCPA) in the United States, and we honour it everywhere.

Incident Response

We have a written incident response plan that the team rehearses. If we confirm a data breach, we notify affected users within 72 hours, as GDPR requires. The notification includes what happened, what data was involved, and what we're doing to fix it.

Responsible Disclosure

If you find a security vulnerability in Chattering, please let us know at support@chattering.ai. We take every report seriously, investigate promptly, and will not take legal action against researchers who follow responsible disclosure practices.