Security. Your data stays yours
Audited, certified and built for businesses that take security seriously.
GDPR
Full compliance with EU data protection standards.
Your data stays yours
Your data is only accessible to your AI agent and not used to train models.
SOC 2 Type II
Independently audited for security and reliability.
Data encryption
Data is encrypted at rest and in transit using standard algorithms.
HIPAA
Eligible on the Enterprise plan for protected health information.
Secure integrations
We use verified variables to ensure users access their own data.
How we protect your assets
Safety is engineered into the platform core, so your integrations and data sources stay shielded.
- Zero Training
No AI Model Training
We explicitly contract with model providers (like OpenAI) to ensure your custom data, links, documents, and active user dialogues are NEVER used to train, retrain, or fine-tune public LLM models.
- AES-256 & TLS 1.3
End-to-End Encryption
All client data is encrypted using military-grade AES-256 encryption at rest inside our PostgreSQL storage systems, and encrypted in-transit across TLS 1.3 networks.
- Strict Isolation
Isolated Tenant Sandboxing
Each SaaS operator account runs in a strictly isolated logical sandbox environment. Users cannot access adjacent client databases, trained embeddings, or conversation indexes.
- 100% Owner
Full Data Ownership
You retain 100% legal ownership of all training sources, documents, and chat records. You can download complete data dumps or trigger permanent hard-deletion of your account data instantly.
- Granular RBAC
Advanced Access Controls
Exert absolute control over operator panels using role-based access configurations. Lock down customizer panels, data source files, and analytics views to designated team members.
- 24/7 Security
Continuous Threat Audits
We execute daily vulnerability scans, automatic edge dependency audits, and continuous network penetration tests to block injection vectors and malicious script executions.
Security questions
Answers to common security and data-handling questions.
Are the uploaded PDF files and custom URLs secure?
Absolutely. When you upload documentation or crawl site links, we process the texts and immediately translate them into vector embeddings. The raw text and embeddings are stored inside our secure, isolated database instances using advanced row-level security. We never expose your source texts or embeddings publicly, and they are fully encrypted both at rest and in transit.
Does OpenAI use our conversation histories to train their models?
No, they do not. CustomerGPT communicates with LLM models using enterprise API channels. Under standard API agreements, model providers (including OpenAI and Anthropic) are contractually prohibited from using API payloads for model training or fine-tuning. Your competitive edge and privacy remain 100% protected.
Where is my data hosted and processed?
Our core PostgreSQL databases and application logic run on secure AWS cloud infrastructure situated in highly redundant US regions. Edge routing and middleware caches are distributed globally across secure CDN networks to keep latency low near your region.
What happens when I delete a chatbot or delete my account?
When you request the deletion of a data source, a chatbot, or your entire client account, our systems immediately initiate a hard-deletion. This permanently wipes out all associated vectors, document indexes, databases records, and logs from our active clusters. Backups are completely cycled and overwritten within 30 days.
Can we sign a Data Processing Agreement (DPA) or Business Associate Agreement (BAA)?
Yes, on the Enterprise plan. It includes a signed Data Processing Agreement (DPA) under GDPR, and it is the HIPAA-eligible plan, so healthcare providers sign a Business Associate Agreement (BAA) as part of it. The Starter, Growth, and Scale plans don't include a signed DPA or BAA.
Procuring for an enterprise?
Our security team supports vendor evaluations, SOC 2 report requests and custom DPA and BAA arrangements.
Contact enterprise security