How we protect your data

• In transit: TLS 1.2+ everywhere. HSTS enforced. Cloudflare Universal SSL on every customer-facing endpoint.
• At rest: AES-256 disk encryption on Postgres + OCI Object Storage. Database backups are encrypted before leaving the host.
• Secrets: environment-variable-only, never committed. Rotation supported on demand.

• Customer data lives in our Mumbai (ap-mumbai-1) Oracle Cloud region by default. No replication outside India unless you explicitly enable it.
• Visitor messages persist for the lifetime of the chatbot, scoped to the chatbot's conversations table. Owners can soft-delete individual conversations or hard-delete via the admin UI; deleted rows are cascade-removed within 24 hours.
• Source content (URLs, PDFs, files you upload) is chunked + embedded for RAG and re-fetched on demand. Originals are stored on OCI Object Storage with object-level ACLs.
• LLM inference goes to your configured provider (Gemini default; OpenAI/Anthropic/local Ollama via BYOK). Provider data-retention policies apply — we recommend reviewing your provider's settings if you handle regulated data.

• Postgres dumps run on every production deploy and at midnight UTC daily.
• Backups retained for 14 days, encrypted, off-host (separate OCI region).
• Recovery target: RPO 24h / RTO 4h for full database restore. Point-in-time recovery within the last 7 days via WAL archiving.
• Blue-green deploys keep the previous container color warm for instant rollback if a release degrades.

• InsiteChat employees access prod only via SSH key + bastion host. MFA enforced on all admin surfaces.
• Customer data is never read by employees in the course of normal operations. Support access requires explicit customer approval per ticket and is logged in the admin audit trail.
• Within your account: chatbots are scoped per user. Multi-seat workspaces are on the roadmap for Q4 2026.

Vendors who process customer data on our behalf. We update this list when a subprocessor is added or removed.

• Every chat-stream exception persists with timestamp + truncated error string for post-hoc investigation.
• Customer-impacting incidents are surfaced in admin within minutes; SEV1 issues trigger an internal alert.
• Post-incident, owners receive a written summary within 5 business days describing root cause, scope, and remediation.
• Status page: coming with the Q3 2026 SOC 2 audit window. Subscribe to release notes via the blog RSS in the meantime.

If you believe you've found a vulnerability, please email security@insitechat.ai. We respond within 48 hours and credit researchers in our changelog with their permission.

Do not exploit the issue in production, do not access other customers' data, and please give us reasonable time to respond before disclosing publicly.