Security & Data Protection

Encryption & Credential Handling

Passwords are never stored in plain text — AIChatVault hashes account passwords using bcrypt. Sensitive integration data, including connected-account credentials and channel access tokens, is stored using encrypted fields rather than plain database columns, so the raw values aren't exposed even if the underlying record is viewed directly.

• Account passwords are hashed, never stored or logged in plain text.
• Connected-channel and store-integration credentials use encrypted storage.
• Lead and customer records captured through the platform are similarly protected.

Organization-Level Data Isolation

AIChatVault is a multi-tenant platform, and every piece of customer data — conversations, leads, knowledge sources, integration connections and delivery history — belongs to a specific organization. Access is authorized against that organization on every request, so one customer's data is never visible to another.

Access Controls

Workspace access is managed per organization. Accounts are assigned roles and permissions rather than every team member sharing one login, and the number of workspace seats available is determined by your plan. The account owner controls who has access to agents, conversations and configuration.

• Role-based permissions control what each team member can view and change.
• Workspace seats are managed per organization, scaling with your plan.
• Account passwords are hashed with bcrypt on every login attempt.

Integration & OAuth Security

Connections to third-party platforms — including Zapier's account-based connection — use OAuth 2.0 rather than shared static credentials. Each authorization is scoped to a single organization, tokens can be revoked at any time from inside your workspace, and disconnecting a provider immediately revokes its active access.

• OAuth 2.0 authorization for supported connected accounts.
• Tokens are issued per organization and can be revoked on demand.
• Disconnecting an integration immediately revokes its stored access.

Webhook & API Protection

Outbound webhook destinations are validated before AIChatVault will send data to them, blocking requests aimed at private, internal or otherwise unsafe network addresses rather than trusting whatever URL is configured. API and webhook endpoints are also rate-limited to protect against abusive or runaway request volume.

Human Oversight & Controlled AI Actions

AI agents operate within the knowledge, instructions and escalation rules your organization configures. Businesses decide which actions an agent is permitted to take through connected integrations, and can configure human handoff for conversations that need a person's judgement rather than letting every interaction resolve automatically.

Your Data, Your Control

You control the knowledge sources your AI agents use and can update or remove them at any time. Integrations you connect can be disconnected from your workspace whenever you choose, immediately revoking their access. For account data or deletion requests, contact our support team directly.

AI Provider Processing

Conversations are processed using the AI models configured for your plan, provided by established AI model providers. AIChatVault does not use your business knowledge or customer conversations to train third-party foundation models.