Security
How we protect your data.
Authentication & Access Control
Account access uses Supabase Auth, database Row-Level Security policies, and server-side authorization. Owners control whether agents are public. Public chat access uses scoped visitor credentials.
Data Encryption
Production services should use HTTPS and encrypted database connections. AI credentials are configured through server environment variables or restricted administrator settings. OAuth integration tokens are encrypted before database storage.
AI & Data Privacy
Configured AI providers process chat messages, conversation context, and relevant knowledge snippets to generate answers. Optional integrations may receive lead details or notification content when enabled. Review the privacy terms of your selected providers.
Widget Security
Agent owners can configure allowed widget origins. Visitor chat requests use signed, scoped sessions, and browser storage is separated by visitor identity. Treat shared devices and embedded browser storage according to your own privacy requirements.
Infrastructure
Chatzora runs on Vercel's global edge network with automatic DDoS protection, CDN, and SSL termination. The database is hosted on Supabase with automated backups and point-in-time recovery.
Compliance & Certifications
Our infrastructure providers (Supabase, Vercel, OpenAI) maintain SOC 2 Type II certifications. We're working toward our own compliance certifications as the product matures.
Have a security question? Contact us