Six pillars, no surprises
Data protection
Your customer data is encrypted everywhere it lives — at rest, in transit, and in backups.
- TLS 1.2+ for all traffic
- AES-256 encryption at rest
- Encrypted database backups
- Per-org logical isolation
Access control
Single sign-on, role-based permissions, and granular API tokens give you fine control over who can see what.
- SSO via SAML 2.0 and OIDC
- Two-factor authentication (TOTP)
- Role-based access (admin / agent)
- Scoped API tokens with rotation
Network security
Lock down dashboard access by IP, and let our infrastructure absorb the rest.
- Optional IP allowlists for the dashboard
- DDoS protection at the edge
- Rate-limited public APIs
- Hardened HTTP headers (HSTS, CSP)
Audit & visibility
Every meaningful change is logged so you can investigate, prove, and improve.
- Immutable audit log for admin actions
- Login & session history
- Outbound webhooks for SIEM
- Optional log export to your S3 bucket
Data governance
A DPA you can sign, a published sub-processor list, and a choice of where your data lives.
- DPA available on request
- Sub-processor list published
- EU and US data residency options
- Per-customer data deletion on request
Reliability
Encrypted daily backups and infrastructure built on Cloudflare's global edge.
- Daily encrypted backups, 30-day retention
- Global edge infrastructure (Cloudflare Workers)
- Uptime SLA available on Enterprise plans
Doing a vendor security review?
Email security@customerhero.app and we'll send our security packet — questionnaire, architecture overview, sub-processor list, DPA, and our current controls inventory. Most reviews take a single pass.
Security FAQ
Your data lives in the region you pick at signup — currently EU (Frankfurt) or US (Virginia). Backups stay in the same region. Enterprise customers can request a custom region.
No. Your conversations and knowledge sources are never used to train any model — ours or our providers'. We pass your prompts to OpenAI with explicit no-training flags, and we don't store the raw prompts beyond what we need to render the conversation.
Yes. The standard CustomerHero DPA is available for any customer to sign — you don't need to be on a paid plan. For enterprise contracts we also support customer-redlined DPAs.
Admins can delete a customer record from the dashboard or via the API; this purges conversations, messages, and PII. Backups age out within 30 days. We'll happily honor written data-deletion requests for any data subject.
Action calls run server-side from CustomerHero with the credentials you provide, and every call is logged in an audit trail. You define the action schema, the AI fills in the parameters; you can require human confirmation before any action runs.