Security
Your customers trust you.Here's how we protect that.
The controls ConvoAI has in place today, described plainly: how data is protected, who can get in, and what the AI is and isn't allowed to do.
Data protection
How your data is handled
HTTPS everywhere
Every page, the API, the widget and webhooks are served over HTTPS.
Encrypted credentials
Channel tokens and integration keys are encrypted before they are stored.
Workspace isolation
Every request is scoped to your workspace, and teammates can be limited to specific AI Employees.
Verified webhooks
Incoming webhooks from Meta, Stripe, Retell and WHMCS are checked for a valid signature; ConvoAI's own outgoing webhooks are signed.
Access control
Who can get in, and what they can do
Two-factor sign-in
Authenticator-app codes with recovery codes. Owners can require two-factor for the whole workspace.
- Enterprise
Single sign-on
SAML 2.0 and OpenID Connect with just-in-time provisioning and an SSO-only option.
- Enterprise
SCIM 2.0
Provision and deprovision teammates automatically from your identity provider.
Roles and permissions
Built-in and custom roles with detailed permissions.
IP allowlist
Limit dashboard access to your office or VPN networks.
Activity log
A record of sign-ins and changes in your workspace.
AI guardrails
What the AI is allowed to do
AI Employees answer from your content and escalate when they aren't sure. On the AI Employee engine, every action is checked before it runs.
Grounded answers
The AI Employee searches your knowledge base before replying and hands over to a person instead of guessing.
Prompt-injection screening
Customer-supplied text that is added to the AI Employee's instructions is screened for known injection patterns.
Test mode
Try an AI Employee safely: nothing is booked, sent or changed while you test.
- Early access
Approvals
Sensitive actions such as refunds wait for a person, and an approval covers one action once.
Is our data encrypted?
All traffic to ConvoAI uses HTTPS. Stored channel credentials and access tokens (for example your WhatsApp and Meta tokens) and the platform's integration keys are encrypted before they are saved.
Is our conversation data used to train AI models?
Your knowledge base and conversations are used to power your own AI Employees. ConvoAI sends conversation text to its AI provider to generate replies; it doesn't share your data with other customers.
Do you have SOC 2 or ISO 27001?
No, ConvoAI doesn't hold security certifications today, and we don't claim them. We'll answer your security questionnaire as part of an Enterprise review.
How do I report a vulnerability?
Send it through the contact form with the topic "Support" and the word "Security" in your message. Please give us reasonable time to fix an issue before disclosing it, and don't access other customers' data while testing.
Security review
Bring us your security questionnaire
We'll walk your team through how ConvoAI works and answer every question plainly.