Security
Your data, handled with care
How we protect your data and your customers' data.
Data handling
Your data, your control
You decide what we store, and for how long.
- Secure infrastructure
- Hosted on AWS with encrypted storage, network isolation, and continuous monitoring.
- Data minimization
- We collect only what the service needs to run. No tracking pixels, no data sales.
- Data retention controls
- Export or delete your conversations and account data whenever you choose.
Encryption
Encrypted everywhere
In transit and at rest, using industry-standard protocols.
- Encryption in transit
- Everything between your browser and our servers travels over TLS 1.3.
- Encryption at rest
- Stored data is encrypted with AES-256 — and so are the database backups.
- Secure authentication
- Passwords are hashed with bcrypt. Sessions live in secure, HTTP-only cookies.
Application security
The everyday details, guarded
How we defend against the most common attack vectors.
- Input validation
- Every piece of user input is validated server-side with strict schemas, closing the door on injection attacks and malformed data.
- XSS prevention
- Chat messages and email content are sanitized before they render, so cross-site scripting never reaches your screen.
- File upload safety
- Uploads are checked for type and size (max 25MB) and stored on encrypted S3 infrastructure.
- Webhook verification
- Incoming webhooks from Stripe and AWS SES/SNS are verified with cryptographic signatures before we process them.
- Multi-tenant isolation
- Workspaces are isolated at the database level. Every query enforces tenant boundaries, without exception.
- Regular updates
- Dependencies are kept current and audited with automated tooling. Vulnerability reports are welcome by email.
Have a security question?
If you have specific security requirements or questions, email us at support@usesonny.com
Start free trial