Trust & Security

Chatsloop is built so that each customer's data is separate from every other customer's, access is limited and logged, and visitors are told when they are talking to an AI. This page is a summary; the legal commitments are in our Terms and Data Processing Addendum.

• Encryption in transit (TLS) for all connections to the dashboard, API and chat widget.
• Encryption at rest for database and file storage (provided by our infrastructure provider). Integration credentials are readable only by server-side code and are never sent to the browser.
• Passwords are hashed by our authentication provider; we never see or store them in plaintext. Card data is handled only by Stripe.
• Configurable retention: you choose how long conversations and leads are kept, and can delete an individual visitor's data at any time.
• Backups are retained for up to 30 days and then purged.

• Tenant isolation using row-level security so one customer can never query another's conversations or leads.
• Agent accounts for your live-chat staff are separate from the account owner and only see the live-chat inbox.
• Optional two-factor authentication (authenticator app) for dashboard logins, enforced on sensitive actions such as exports, deletions and chatbot removal.
• Rate limiting and brute-force protection on sign-in and public endpoints.
• Chatsloop staff access is limited to support and security needs. Every time staff open your account it appears in your own Security → Recent activity log, and you can switch support access off entirely.

• Only the visitor's question, the relevant excerpts of your knowledge base, your instructions and recent conversation context are sent to the AI provider. IP addresses, billing data and credentials are never sent.
• Customer Data is not used to train AI models; our provider's API terms exclude training on it by default.
• Assistants for law firms display a fixed notice that the visitor is talking to an AI, that nothing is legal advice, and that no attorney–client relationship is formed.

• Server-side checks on every protected API route; webhook signatures verified.
• Protection against server-side request forgery for crawled URLs and outbound webhooks.
• Input validation, output escaping and CSV-injection protection on exports.
• Domain locking so a chat widget only works on the website you authorise.
• Regular internal security reviews; findings are tracked to resolution.

Visitors are identified only by a random browser ID — no login and no cross-site tracking. If a firm collects contact details, the visitor sees a consent notice first. Visitors can ask the firm to delete their data, and the firm can do so from the dashboard.

We maintain an incident response process and will notify affected customers without undue delay and within 72 hours of becoming aware of a personal data breach affecting their data, as set out in the Data Processing Addendum.

We are transparent about where we are: we do not currently hold a SOC 2 or ISO 27001 certification. We operate to GDPR, UK GDPR and CCPA requirements, publish a Data Processing Addendum and subprocessor list, and will share a completed security questionnaire on request at privacy@chatsloop.com. We do not claim HIPAA compliance and do not sign Business Associate Agreements, so do not use Chatsloop to collect protected health information.

If you believe you have found a security issue, email security@chatsloop.com with the details. Please give us reasonable time to fix it before disclosing it publicly, and do not access other customers' data. We will acknowledge your report within three business days.