Security
Security at Chatsy, including what we do not offer yet
Chatsy encrypts integration credentials, hashes passwords and limits each teammate to the resources they are given. It does not have a SOC 2 report, a signed HIPAA BAA or single sign-on. This page lists both, so you can decide before you buy.
In place
Controls in the product today
| Control | What it does |
|---|---|
| Integration credentials | OAuth tokens and API keys are encrypted with AES-256-GCM before they are stored. They are decrypted on the server for provider requests and are not exposed to the browser. |
| Passwords | Stored as one-way bcrypt hashes. A hash cannot be read back as the original password. |
| Workspace roles | Admins manage members and every resource. Members only reach the agents, mailboxes and knowledge bases they are given, at View, Edit or Manage level. |
| Custom API tools | Tool endpoints must use HTTPS and cannot point at private or reserved network addresses. Requests time out after 15 seconds. |
| Public access switch | An agent is private until you turn on Allow public chats. With it off, the widget script does not load anywhere. |
| Visitor attachments | Visitors can attach up to 3 files of 3 MB each, limited to JPEG, PNG, GIF, WebP images and PDF. |
Not offered yet
What Chatsy does not have
If your review requires any of these, Chatsy is not the right tool today. Contact us before buying rather than after.
- SOC 2 Type II reportNo audit report is available.
- Signed HIPAA BAADo not use Chatsy for protected health information.
- Single sign-on (SSO / SAML)Team members sign in with their own Chatsy accounts.
- Published data retention periodChatsy has not published a fixed retention schedule.
- Self-serve account export or deletionRequests go through the contact form.
- Widget domain restrictionA public widget script can be loaded on any site.
Your data
What Chatsy stores
- Account details
- Name, email address and authentication information
- Content you add
- Documents, text, website URLs and knowledge base articles, processed and indexed so an agent can find relevant passages
- Service records
- Conversations, messages, leads, tickets, usage totals and technical records needed to run, secure and troubleshoot the service
You can remove individual sources and agents from the dashboard. Account export, account closure and deletion are requests through the contact form; Chatsy may keep records it needs for security, billing, disputes, backups or legal obligations.
Who else processes it
To answer a question, Chatsy sends the prompt, the relevant passages from your sources and any tool inputs to the AI provider that runs the model you chose. Hosting, database, authentication, email, billing, analytics and integration providers may also process data to run the service, under their own terms. Chatsy does not publish a named list of these providers.
Chatsy does not sell or rent personal data.
Before you buy
Questions to answer in your own review
Most risk in an AI support tool comes from what you add to it and who can see it. Work through these with whoever owns security at your company.
- 01Will visitors share data you are not allowed to process with an AI provider (health, payment card or government ID data)?
- 02Do you need a SOC 2 report, signed BAA or SSO before purchase? If so, Chatsy is not a fit today.
- 03Who in your team needs Admin, and who should be a Member with access to one mailbox or agent only?
- 04Which sources are you adding? Anything you add can be quoted to visitors.
- 05Do you need a retention period or deletion date in your contract? Ask before you buy.
- 06Should the agent be public only on launch day? Keep Allow public chats off until then.
FAQ
Security questions we get
Need an answer for your security review?
Tell us what your review requires. We will say plainly whether Chatsy meets it today.