Security
Your customers trust you. We take that seriously.
Envoy handles your customers' messages and your business knowledge. Here is how we keep them separated, protected and in the hands of the right people.
Every organisation is walled off.
Tenant-scoped by design
Every chatbot, conversation and contact belongs to one organisation, and every request is checked against the organisation you are signed in to.
Separate knowledge
Your indexed documents live in a partition for your organisation, and searches only ever look inside it. One customer's bot can't answer from another's data.
Encrypted credentials
WhatsApp and other channel access tokens are encrypted at rest and only used to send and receive messages on your behalf.
The right people, and only them.
Role-based access
Admins manage the organisation. Builders work on chatbots. Agents see the conversations assigned to them. Members can be removed in a click.
Signed embeds
Each web widget uses an embed key that only works on the domains you allow, and can be regenerated at any time.
Signed webhooks
When a chatbot calls one of your tools, the request is signed, and callbacks are verified before anything is processed.
Rate limiting
Public endpoints are rate limited to protect your chatbots and your bill from abuse.
Secure sessions
Sign-in uses server-side sessions in secure cookies, with password reset by email.
A human stays in control
Agents can take over any conversation from the AI at any moment, and it's always clear who is replying.
Responsible disclosure
Report an issue Found a vulnerability? Tell us first.
Email contact@softservedweb.com with the details and steps to reproduce. Please give us a reasonable chance to fix it before sharing it publicly. For how we handle personal data, read our privacy policy.