Security and compliance
How we protect your data and your customers' data.
Hosting in the EU
The platform runs on managed cloud infrastructure in a European Union region, with daily backups and tested restores.
Encryption
Data is encrypted in transit (TLS 1.2 or higher) and at rest. Channel tokens and API keys are stored in a dedicated secrets vault.
Store isolation
Every store's data is separated at the database level, so one store can never see another's data.
AI processing
AI providers process data under zero-retention agreements and never use it to train their models. Card numbers are never stored.
Access control
Role-based permissions, optional two-factor authentication, and an audit log of sensitive actions, including staff access.
Compliance
We follow the GDPR and Tunisian personal data law (Organic Law 2004-63), as well as Meta and WhatsApp Business policies.
Testing and incidents
Independent penetration test before launch and every year, continuous dependency scanning, and a documented incident response process.
Sub-processors
The final list is published at launch and updated before any change.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, storage | EU (France) |
| OpenAI | AI models for the agent's replies and voice-message transcription | US |
| Anthropic | AI models for the agent's replies | US |
| Vercel | Website and dashboard delivery | EU |
| Meta Platforms | WhatsApp, Instagram and Messenger messaging | Global |
| Stripe | Card payments and invoicing | EU / US |
| Sentry | Error monitoring | EU |
Data processing agreement
Every plan includes our data processing agreement. Ask for a copy and we will send it within one business day.
Request the DPA