How we protect your data
A plain description of the safeguards in Frontal Chat today. We don’t hold security certifications such as SOC 2 or ISO 27001 yet, and we won’t claim them until we do.
Separate workspaces
- Every record belongs to one workspace, and every request is checked against the signed-in user’s workspace and role.
- Isolation between workspaces is covered by automated tests that try to read and change another workspace’s data.
Accounts
- Passwords are stored as salted bcrypt hashes; sign-in requires a confirmed email address and is rate limited.
- Changing or resetting a password signs out every other session.
- Roles limit what each user can do; only the owner manages billing and the team.
Data in transit and at rest
- All traffic uses HTTPS.
- AI provider keys you add are encrypted with AES-256-GCM before they are stored.
- Chat visitor sessions use random tokens stored only as hashes.
- Servers are hosted by DigitalOcean, New York (United States). The database is backed up daily.
Your website and the chat
- Website imports run on our servers with strict limits and refuse internal or private network addresses.
- The chat window runs isolated from your page’s code and styles, and you can restrict which of your domains may load it.
- Payments are handled by Stripe; card details never reach our servers.
Report a vulnerability
Email us with the details and steps to reproduce. Please don't access or change other people's data, run denial-of-service tests or send spam while testing. We'll confirm receipt and keep you updated.
How we handle personal data is described in the Privacy Policy; the companies that process it for us are on the subprocessors page.