Security & AI Data Training Disclosure
How we protect your workspace data, enforce tenant isolation, and ensure zero public model training.
Zero Foundation Model Training Commitment
Your company's sales pitch scripts, practice conversation transcripts, rep objection handling logs, and internal coaching feedback remain strictly confidential to your workspace. Neither SalesChat nor our cloud inference partners (including Groq Inc.) use your proprietary simulation inputs or outputs to train, fine-tune, or improve public foundation models.
1. AI Data Governance & Zero-Retention Inference
We architected SalesChat with an enterprise-first AI boundary. When reps engage in interactive practice sessions:
No customer prompt, practice dialogue, or scoring critique is ever shared with third-party LLM providers for the purpose of training public models.
Inference requests sent to our Groq LPU processing cluster are processed in memory and discarded immediately upon completion of response streaming.
2. Encryption in Transit & at Rest
SalesChat implements industry-standard cryptographic protocols to protect data across all states:
- Encryption in Transit: All data transmitted between your browser, SalesChat servers, and third-party subprocessors is secured using modern TLS 1.3 and HTTPS encryption with strict HTTP Strict Transport Security (HSTS) headers.
- Encryption at Rest: All database records, user credentials, conversation histories, and analytics are stored on encrypted volumes utilizing AES-256 encryption managed by Supabase on Amazon Web Services (AWS) data centers.
- Secure Cookie Flags: Authentication tokens are transmitted strictly via encrypted, HttpOnly, SameSite=Lax session cookies that are inaccessible to client-side scripts.
3. Multi-Tenant Isolation (Defense-in-Depth)
We employ a defense-in-depth isolation framework to prevent any possibility of cross-tenant data leakage:
PostgreSQL Row Level Security (RLS)
Database tables enforce granular RLS policies. Queries execute with tenant-authenticated contexts ensuring users can only read or write rows that belong to their authorized workspace.
Explicit Application-Level Tenant Scoping
As a second line of defense, our server API routes explicitly enforce organization ID filters (.eq("organization_id", orgId)) and validate sub-resource ownership before querying the database.
Tenant-Partitioned Caching & Locks
All temporary Redis cache entries and concurrency locks are strictly partitioned by organization and user keys (e.g., orgId:userId), completely preventing cross-tenant cache bleeding.
4. Application Hardening & Error Sanitization
We protect user experience and infrastructure integrity by applying strict API hygiene:
- Sanitized Error Responses: API endpoints never expose raw stack traces, database schema details, or third-party SDK exception strings to the client. Internal errors are logged securely on the server while returning clean, sanitized error messages to the user.
- Brute-Force & Abuse Mitigation: Upstash Redis sliding-window rate limiters protect mutation endpoints, authentication routes, and AI generation calls against automated abuse and denial-of-service attempts.
- CSRF Protection: Mutation requests require verified origin headers matching trusted application domains.
5. Subprocessor Security & Due Diligence
Every external infrastructure vendor we partner with is evaluated for stringent data security compliance, including SOC 2 Type II certifications, ISO 27001 compliance, and adherence to GDPR Data Processing Addendums.
For a complete, transparent directory of our third-party infrastructure and AI processors, please visit our dedicated Subprocessors Directory.
6. Vulnerability Disclosure Program
We welcome responsible security research. If you discover a security vulnerability or suspect an unauthorized access attempt, please report it immediately to our security engineering team at:
Please include steps to reproduce, affected endpoints, and any relevant payload logs. We commit to acknowledging reports within 24 business hours and will not pursue legal action against researchers acting in good faith under safe harbor guidelines.