Security and your data
How your data and your visitors' data are protected, and what happens to it.
Your connected accounts are stored as encrypted tokens rather than passwords, decrypted only on our servers and never sent to a browser. Every account's data is separate, your database is in Australia, and your Aijent only runs on websites you have added. If you cancel, your data stays recoverable for about six weeks and is then permanently deleted.
Your connected accounts
When you connect a calendar, a CRM or Slack, we store an access token rather than your password. Those tokens are encrypted before they are stored, using AES-256-GCM.
They are only ever decrypted on our servers, at the moment they are used. They are never sent to a browser and never written into logs.
You can disconnect any integration at any time, which removes our access.
Keeping accounts separate
Every piece of data belongs to exactly one account, and every request is scoped to the account making it. There is no shared pool of conversations or leads.
Two-factor authentication
Turn it on from your account settings. It uses a standard authenticator app such as Google Authenticator or 1Password, and you will then be asked for a code when you sign in.
There are no backup codes
If you lose your authenticator you cannot reset this yourself, and you will need to contact support. Before turning it on, make sure your authenticator app is backed up, or add a second device.
Your Aijent will not run on the wrong website
Your Aijent only runs on websites you have added to your account. That is why adding your website is a separate step from pasting the code: it stops your install code being copied and used on a site you do not own.
Each conversation also runs on a short-lived signed session issued and checked by our servers.
What your visitors see
Your Aijent answers only from the knowledge you give it. It cannot reach any other customer's data, and it knows nothing about your business beyond what you have provided.
Conversations are stored against your account so that you can read them, export them and pass them to your CRM.
Who processes your data
Running your Aijent involves a small number of specialist providers, for:
- Hosting
- The database, which is in Australia
- Generating replies
- Reading your website
- Payment processing
- Email delivery
If you need the full current list for a security review or a procurement questionnaire, get in touch and we will provide it along with where each one operates.
Deleting your data
If you cancel, your account stays recoverable for a grace period of about six weeks in case you change your mind.
After that it is permanently deleted: your account, your Aijents, your conversations, your leads, your knowledge base and your connected accounts. That deletion is complete rather than a flag on a record, and it cannot be undone.
If you need your data removed sooner than that, ask us.
Answering a security questionnaire
If a customer of yours is assessing you and needs detail we have not covered here, get in touch. Tell us what they have asked for and we will answer it directly, rather than leaving you to translate.