Security
What we do to keep your account, your customers' conversations and your payments safe.
- Passwords
- Passwords are never stored in plain text. They are hashed with bcrypt before they are saved.
- Access to your data
- Conversations, leads, bots, flows and analytics belong to a workspace. Every request is checked against workspace membership before anything is returned or changed.
- Payments
- Checkout and billing run on Stripe's hosted pages, so card details are handled by Stripe and never pass through our servers.
- The AI model
- Replies are generated by Google Gemini on Vertex AI, in a Google Cloud project used only for Chatmefy. Spending on the model has hard daily and monthly limits.
- Abuse protection
- The chat API is rate-limited per visitor and per IP address, and message length is capped, so a single visitor can't flood your assistant.
- Scheduled jobs
- Background jobs such as auto-resolving idle conversations and re-reading your website can only be triggered with a secret key.
Found a vulnerability? Write to security@chatmefy.com and we'll get back to you.