All traffic to the website, the dashboard, the API and the chat widget uses HTTPS (TLS 1.2 or higher).

Passwords are stored only as salted bcrypt hashes; we cannot read them.

Credentials that you give us to connect channels and integrations, such as access tokens for WhatsApp, Telegram and Google, are encrypted at rest with AES-256-GCM and are never returned to the browser in full.

Each company is a separate workspace. Every request is checked against the workspace named in the signed session, and people see only what their role allows (company owner, administrator or employee). Platform operators use separate privileged roles.

Isolation between companies is enforced by the application on every query. The database does not add a second row-level barrier today.

Access tokens expire after two hours and are renewed with a refresh token that lasts at most seven days. Two-factor authentication with an authenticator app is available for accounts.

Public forms are protected by captcha, and the API and the chat widget are rate limited. Webhooks from Meta, Telegram and our payment provider are verified by signature or secret before they are processed.

Answers are generated through the OpenAI API using the knowledge your company provides and the conversation in progress. By default our requests ask OpenAI not to store responses.

We do not use your content to train AI models. The providers we use for AI and everything else are listed on the subprocessors page.

The production database is backed up automatically to private object storage that is separate from the server that runs it.

Health checks and background-job alerts run continuously. The current state of the service is on the status page.

Write to info@faheemly.com with the subject Security. We read every report and fix confirmed issues promptly. We will not pursue good-faith researchers who avoid other people's data and do not disrupt the service. A machine-readable contact is published at /.well-known/security.txt.

Faheemly does not currently hold SOC 2 or ISO 27001 certification and has not published an independent penetration test. This page describes our own controls so that you can assess them.