Customer ServicePro.

Security Overview

last updated 2026-05-12 · v1.0

What we do, what we don't, and what's still in motion. This document is written for the person at your company who will sign the security questionnaire.

1. Architecture in one sentence.

Customer messages enter through tenant-scoped webhook endpoints, get routed to Aria with retrieval over your encrypted tenant knowledge base, and return through the same channel they came in on. Sensitive values are stripped before any transcript is persisted to a ticket, handed to your team, or written to a log (see PII redaction below). Every step is logged. No customer data passes through our marketing infrastructure.

2. Encryption.

3. PII redaction pipeline.

Every customer message is scanned for sensitive content. Matched values are stripped before the transcript is written into a support ticket, handed to your team, or recorded in an audit log. Pattern coverage today:

Matched values are replaced with [REDACTED] in the persisted transcript — the version that lands in tickets, team handoffs, and audit logs. Redaction runs on the way in, before the message reaches the model or the session transcript, so the original is not retained anywhere. Emails and phone numbers are kept in tickets so your team can act on them; audit logs strip those too.

4. Tenant isolation.

Knowledge base files and conversation history are isolated per tenant. Server-side resolution selects the tenant's active OpenAI vector revision; browser requests cannot supply an authoritative vector-store identifier. Every indexed document carries tenant, version, full content hash, and source attributes, and cross-tenant retrieval probes gate activation.

Aria's reasoning loop has no path to the file index of any other tenant. There is no shared embedding space across customers.

SMS phone numbers follow the same isolation discipline. A phone number is stored under one partner tenant, used only within conversation threads that originated from that partner's intake, and never reused across tenants. Outbound SMS routes through a per-tenant Twilio Messaging Service so messages carry the partner's brand identity at the carrier level, not ours. Each partner's toll-free number goes through Twilio Toll-Free Verification before SMS is enabled (unverified → pending → verified); see the compliance roadmap for current status. Opt-out state (cs_pro_sms_opt_out) is partner-scoped: opting out of one partner's SMS does not opt out of another's.

5. Authentication and access control.

6. Logging, monitoring, and incident response.

Every conversation turn produces a structured audit record: tenant ID, timestamp, model used, latency, tool calls, redaction matches, and outcome (resolved / escalated / failed). Audit records are retained 12 months, append-only, with restricted access. Each row is hash-chained to the one before it and its own contents, so a record cannot be altered or removed after the fact without the chain failing verification. PII in the record body is redacted at write time rather than on a retention timer.

We monitor for anomalies in error rates, latency tails, and authentication patterns. Confirmed incidents are communicated to affected customers within 24 hours of confirmation, with a written postmortem within 7 business days.

7. Vulnerability management.

8. Backup and recovery.

Database backups are managed by Supabase's automated backup mechanism for our current plan; ask us for the retention window and recovery options in force on the day you sign, and we will show you the plan we are on rather than a tier we are not. Knowledge bytes and immutable vector revisions are versioned by full content hash, so a validated prior OpenAI revision can be reactivated per tenant. The full backup procedure is documented in the operations runbook.

9. Compliance roadmap.

SOC 2 Type I: engaging Vanta; target Q4 2026. SOC 2 Type II: 12 months after Type I sign-off. HIPAA: BAA template drafting, target Q1 2027 (gated on Type I completion). GDPR: standard contractual clauses + Data Processing Agreement template drafting, target Q1 2027. Data residency: all customer data is stored and processed in the United States. We do not currently offer EU region pinning on any plan, and we will not sell it until a second region is actually running.

Honesty note. Items in this section that say "in progress" or "drafting" mean exactly that. We do not claim certifications we don't hold. Our hosted CI pipeline is currently suspended for billing reasons, so the checks it defines run deliberately before a release instead of automatically on every commit; the test suite, the dependency audit, and the release gates are all still run, and a release is not cut until they pass. Ask for the current state of any item and we'll show you what's actually shipped versus what's on the roadmap.

10. Subprocessors.

We use a small set of infrastructure providers, each used under the data-processing terms in its own standard customer agreement. We have not yet executed separate negotiated Data Processing Agreements with these providers. We will put one in place before processing customer data on behalf of a business that requires it; if that is a procurement condition for you, ask us for the current status before you sign. Current list, with the reason each is necessary:

Full subprocessor list with addresses and processing categories: available on signed NDA. We give 30 days' notice before adding a new subprocessor.

11. Responsible disclosure.

If you find a security issue, send a responsible disclosure. We acknowledge within 1 business day, triage within 5, and credit researchers in our public security notes if you'd like.

12. Contact.

Security questionnaires, SOC 2 letter requests, BAA requests, custom architecture diagrams: contact us.

if a claim here turns out to be inaccurate, tell us · we'll fix it publicly