The Security Behind Chatmefy's AI Infrastructure

When you trust Chatmefy with your customer conversations, you're trusting us with some of your most valuable data. We take that responsibility seriously. Here's how we protect it.

Our Security Principles

Everything we build is guided by three core principles:

1. Defense in depth: Multiple layers of security, never single points of failure
2. Least privilege: Access only to what's needed, nothing more
3. Continuous improvement: Security is never "done" — we're always getting better

Data Encryption

In Transit

All data transmitted between your browser, our servers, and any integrations uses TLS 1.3, the latest and most secure version of the Transport Layer Security protocol. We enforce HTTPS everywhere — no exceptions.

At Rest

All stored data is encrypted using AES-256, the same encryption standard used by banks and governments. Encryption keys are managed using hardware security modules (HSMs) and are rotated regularly.

In Processing

Our AI processes conversations in isolated, ephemeral environments. Data is decrypted only during processing and never persists in unencrypted form.

Infrastructure Security

Cloud Architecture

• Multi-region deployment: Data stays in your preferred region (US, EU, APAC)
• Isolated environments: Each customer's data is logically separated
• Redundancy: No single point of failure; automatic failover
• DDoS protection: Enterprise-grade protection against volumetric attacks

Access Controls

• Zero trust architecture: Every access request is verified
• Role-based access: Employees only access what they need
• Multi-factor authentication: Required for all internal systems
• Audit logging: Every access is logged and monitored

Compliance & Certifications

Data Handling

What We Store

• Conversation messages and metadata
• User and visitor information you collect
• Analytics and usage data
• Knowledge base content you provide

What We Don't Store

• Credit card details (handled by Stripe)
• Passwords in plain text (hashed with bcrypt)
• AI training on your specific data (unless you opt in)

Data Retention

You control how long we keep your data. Default retention is 90 days for conversations, but you can extend or reduce this. When data is deleted, it's gone — we use cryptographic erasure to ensure unrecoverability.

Incident Response

Despite our best efforts, incidents can happen. Here's how we handle them:

1. Detection: 24/7 monitoring with automated alerting
2. Response: On-call security team responds within 15 minutes
3. Communication: Affected customers notified within 24 hours
4. Remediation: Root cause analysis and preventive measures
5. Post-mortem: Transparent incident reports published

Enterprise Options

For organizations with advanced security requirements, we offer:

• Self-hosted deployment: Run Chatmefy on your own infrastructure
• SSO integration: SAML 2.0, OAuth, and custom IdP support
• Custom DPA: Data processing agreements tailored to your needs
• Penetration testing: Annual third-party security assessments
• Security reviews: We'll participate in your vendor security questionnaires

Questions?

Security is too important for unanswered questions. If you have concerns about our security practices, please contact our security team. For enterprise security inquiries, reach out to security@chatmefy.com.