Security principles
Chatoo processes customer conversations so your business can answer chats and calls. That means security is about access, isolation, retention, and control of knowledge sources — not absolute marketing slogans.
This page summarizes the operational model. Legal terms remain in our Privacy Policy and Terms. Where this page and those documents differ, the legal documents win.
Hosting and isolation
- Application and data services run on Google Cloud / Firebase infrastructure used by the Chatoo production project.
- Customer workspaces are separated logically in application data (workspace-scoped records and rules).
- Dashboard access requires authenticated users with workspace permissions.
Knowledge and model behaviour
- Agents are configured to use customer-approved knowledge you connect or upload.
- You decide which sources are live. Remove a source when it is outdated.
- When the agent is unsure, it should clarify or escalate rather than fabricate policy.
- Do not put secrets (API keys, passwords, card data) into knowledge documents.
Conversations and attachments
- Chat and voice transcripts are stored so your team can review handoffs and improve answers.
- Attachment and knowledge storage are metered separately on plans — see pricing for limits.
- Use the product tools and support process to request deletion aligned with your retention needs and our privacy policy.
Access controls
- Invite only the teammates who need inbox or admin access.
- Use role permissions on plans that include them.
- Rotate access when staff leave. Workspace admins are responsible for joiner/mover/leaver hygiene.
Subprocessors and model providers
Chatoo uses cloud infrastructure and AI model providers to generate replies and voice. Provider lists and processing details are maintained under our privacy documentation and customer agreements. Contact us if you need a current subprocessors summary for procurement.
Compliance posture
We design for responsible SMB use of conversation AI. Formal certifications (for example SOC 2) should only be claimed when an independent report is available — ask sales for the current status rather than assuming a badge on marketing pages.
Incident and support contact
Security concerns: use contact with subject “Security” and include only non-sensitive details in the first message. We aim to respond within one business day.