ChatSys Security: Enterprise-Grade Encryption, Isolation & Compliance

All traffic between your browser, your visitors' chat widgets, and ChatSys is served over TLS 1.3, the latest transport encryption standard. Data is encrypted at rest with AES-256 by our infrastructure provider, so even the underlying storage is unreadable without the keys.

Account credentials are bcrypt-hashed and never stored in plain text. This matters: the Verizon 2025 Data Breach Investigations Report found that 74% of breaches involve credential abuse. By salting and hashing every credential, a database snapshot is useless to an attacker trying to reuse passwords.

Every workspace is isolated at the database layer with PostgreSQL row-level security (RLS). A query scoped to one customer physically cannot return another customer's rows — the isolation is enforced by the database engine itself, not merely by application logic that a bug could bypass. This is a structural guarantee rather than a best-effort filter.

• ·Least-privilege service roles: admin surfaces are gated separately from customer authentication.
• ·Sub-admins get scoped Editor or Viewer access — Viewers can read but cannot mutate anything.
• ·Administrative actions are written to an append-only audit log that cannot be silently edited.

Billing runs entirely through Stripe. Card data is handled by Stripe's PCI-DSS Level 1 infrastructure — the highest level of payment-card compliance. ChatSys never sees or stores full card numbers, which keeps your payment data out of our scope and inside Stripe's certified environment.

ChatSys is GDPR-ready. We make a Data Processing Agreement (DPA) available on request, document our sub-processors, and support data-subject rights including access, export, and deletion. In the event of a personal-data breach, we commit to notifying affected customers within 72 hours. See our Privacy Policy for details.

ChatSys operates SOC 2-aligned controls today — encryption, least-privilege access, and append-only audit logging — and a SOC 2 Type II examination is currently in progress. If you need our current posture for a vendor review, our Enterprise team can share security questionnaire responses.

Here is how ChatSys's security posture compares with other AI chatbot platforms across the controls that matter most for protecting customer data.

Found a vulnerability? We appreciate coordinated disclosure. Email security@chatsys.ai with details and steps to reproduce. We acknowledge every report within 2 business days and ask that you give us a reasonable window to remediate before any public disclosure.