Trust and security

How we protect your customers’ data, stated plainly.

This page describes what the platform does today, including what we have not done yet. Every statement can be checked in a security review: write to contact@aiactivesupport.com.

Book a free demo

Isolation and access

Each brand’s data is separated in the database itself.

Tenant isolation: Row-level security on every table: the database checks, for each request, that the signed-in person belongs to the brand. A guessed or forged identifier returns nothing. Records can only reference records of the same brand, even for our own server code.
Role-based access: Nine roles, from owner to read-only viewer, with permissions checked on the server for every action and again by the database. Nobody can raise their own role, and refunds above an agent’s limit need an approver.
External agents see only their work: Outsourced agents see the open queue, their own conversations, and only the customers and orders behind them.
AI Active Support staff access: Our platform administrators can read client data only from a session confirmed with two-factor authentication. In a client’s portal they are read-only; their changes go through dedicated, audited actions.

Encryption

Encrypted in transit, and secrets encrypted by us.

In transit: Every connection uses HTTPS (TLS). Browsers are told to never use plain HTTP (HSTS), and the application talks to the database over HTTPS.
At rest: The database and stored files are encrypted at rest by our database provider, Supabase, on its storage. We do not add our own encryption to every row.
Integration secrets: Shopify tokens and WhatsApp, Instagram and Messenger access tokens are encrypted by AI Active Support with AES-256-GCM before they are stored, in a table no API can read. They are never shown in the portal, logged, or given to the AI.
Other secrets: Inbound email secrets, chat session tokens and invitation links are stored only as hashes. Passwords are handled by Supabase Auth and never stored in readable form.

Accounts

Sign-in, two-factor authentication and audit logs.

Two-factor authentication: Available to every account with any authenticator app. A brand can require it for its owners, admins and operations managers; the database then refuses their access until the code is confirmed.
Sessions: Secure cookies that page scripts cannot read, sign-in rate limiting, and changing a password signs out other devices. Owners and admins can sign team members out of every device from Settings → Security.
Audit logs: Role changes, invitations, approvals, AI and knowledge changes, integrations, exports and erasures are recorded with who and when, in a log that cannot be edited. Owners and admins read it in Settings.
Security events: Sign-ins, failed sign-ins, password changes and two-factor events are recorded. Each person sees their own; owners and admins see their team’s, without IP addresses.

What the AI receives, and what it cannot do.

Data sent to models: The message being answered, the conversation, relevant knowledge excerpts and order facts. Personal details are masked and card numbers and IBANs are removed before anything is sent.
Model providers: Requests go through OpenRouter, restricted to model providers that do not collect prompt data. Your data is not used by AI Active Support to train models.
No actions: The AI has no tools. It cannot refund, cancel, change an order or a payment: it drafts or recommends, and a person decides.
You control it: AI can be off, draft-only (a person sends every reply) or automatic for the topics you allow. Topics involving money or order changes can never be automatic.

Your data

Retention, deletion and backups.

How long data is kept

Conversations, customers, orders, knowledge, files	For the duration of the contract, then deleted (below)
A deleted organization	Hidden at once, fully purged after 30 days (rows and files)
A customer erased on request or by Shopify	Deleted at once, with their files and orders
Audit log	For the life of the organization (append-only)
Security events (sign-ins, with IP address)	1 year
Read notifications	180 days
Background jobs	14 days when done, 30 days when failed
Provider webhooks	30 days when processed, 90 days when failed
Operational telemetry (no message content)	14 days
Website enquiries (leads)	3 years after the last contact
Anonymous website counts	13 months

Export: Owners and admins can export all of their brand’s data at any time.
Customer deletion: A customer can be erased on request: their conversations, messages, files and orders are deleted. Shopify’s privacy requests are handled the same way, automatically.
End of contract: Deleting the organization disconnects its stores and cancels its subscription at once; every row and file is purged 30 days later.
Backups: The database is backed up by Supabase according to our project plan. Continuous point-in-time recovery is not enabled yet; we will update this page when it is. Erased data disappears from backups when they expire.

Shopify

Read-only access to your store.

One permission: AI Active Support asks Shopify for read_orders only: orders, their items, fulfillments and tracking. No product, customer list, payment or store-settings access.
No changes to your store: AI Active Support cannot create, edit, refund or cancel anything in Shopify. Refunds and order changes are made by a person in your store admin.
Verified webhooks: Every Shopify webhook is checked against its signature before it is read. Uninstall and privacy webhooks are handled.
Disconnecting: Disconnecting the store from AI Active Support uninstalls the app and deletes its token.

Incidents

How we detect and handle incidents.

Detection: Automated checks run every 10 minutes on every component (database, channels, AI, integrations, background processing) and alert our team on an outage or a lasting degradation.
Response: A written procedure sets severity levels, who responds and how fast, how to contain the problem, and how to rotate any secret involved.
Telling you: Affected clients are told directly, and incidents are posted on our status page. A personal-data breach is notified to you without undue delay, so you can meet your own obligations.
Afterwards: Every significant incident gets a written review with its cause and the actions taken.

Certifications and audits

What we do not have yet.

We would rather tell you than let you assume.

AI Active Support does not currently hold, and does not claim:

SOC 2
ISO 27001
PCI DSS certification
an independent penetration test report
a published uptime figure

Our providers hold their own certifications (see their pages linked from our subprocessors list); those cover their infrastructure, not AI Active Support.

What we do instead: On every code change, automated tests check tenant isolation, permissions and database privileges against a real database, dependencies are audited for known vulnerabilities, and the code is scanned for security issues and leaked secrets. Our internal security review is documented and its findings tracked.
Your own review: We answer security questionnaires and can walk your team through the controls described here.

Shared responsibility

What stays in your hands.

Your team’s accounts: Require two-factor authentication, give each person the lowest role they need, and remove people who leave. Settings → Security shows all of this in one place.
Your channels: Restrict the chat widget to your own domains, and keep your Shopify and Meta accounts secured on their side.

FAQ

Questions, answered plainly.

Something else on your mind? Talk to our team

Do you sign a data processing agreement?

Yes, with every client. For your customers’ data we act as a processor on your behalf.

Do you see card numbers?

No. AI Active Support never receives or stores payment card numbers. Subscription payments go through Stripe’s own pages.

Can we get a security questionnaire answered?

Yes. Write to contact@aiactivesupport.com: we answer with what the platform actually does, including what it does not do yet.

Where is our data hosted?

The application runs on Vercel, Dublin, Ireland and the database on Supabase (AWS eu-west-1, Ireland). Our subprocessors page lists every provider and its location.