Your customers' data is protected at the architecture level
We don't bolt security onto a finished product — isolation, encryption and access control are built into the service itself. Here is exactly what is done.
Every company on its own
Data of different companies is never mixed at any level.
A separate database schema for each company
A separate area of file storage with its own prefix
Tokens of connected bots and service keys are stored encrypted in the database
Every request runs strictly in the context of the user's company
End-to-end encrypted team chats
Internal conversations can only be read by the chat participants.
End-to-end encryption: the server stores only ciphertext
Private keys never leave the employee's device
Access is recovered with a secret phrase known only to the key owner
Modern cryptography (libsodium)
Encrypted workspace requests
Data is protected not only by HTTPS but also at the application level.
Request bodies are encrypted: ECDH P-256, HKDF and AES-256-GCM
Protection against replaying intercepted requests
Each request is bound to its own method and path
The owner can enable a “encryption required” mode
Access only for those who should have it
Employee permissions are configurable down to the last button.
Flexible roles and permissions: everyone sees only their own scope
Two-factor authentication and IP address restrictions
Passwords are stored only as strong Argon2id hashes, and the owner sets the password policy
Limits on sign-in attempts and brute-force protection
Everything is recorded
Every significant action can be traced.
Action log: who changed roles, employees and settings
A request log for incident investigation
Platform staff access to your company is temporary and recorded in a separate log
Notifications about significant security events
You control your data
Your data is your data.
We do not sell or share customer data for advertising
Data export using the workspace tools
Company deletion: first the trash with the option to restore, then permanent deletion
Data is shared with contractors only where the service cannot work without it
We describe only implemented measures and do not claim certifications we do not hold.
Need a security questionnaire or want to discuss your company's requirements?
