How Zenvi protects your data
Passwords are hashed, never stored in plain text. Sessions use signed, HTTP-only cookies. Every customer's data is isolated from every other customer's at the database query level. Your chatbot widget only works on domains you approve. HTTPS is enforced site-wide.
Data isolation
Every piece of data, your leads, conversations, bot settings, belongs to your account and is filtered by account ID on every single query, through a centralized access layer the whole app routes through. No page or API route queries the database directly without that filter. This is the same approach that closed a real cross-account data leak found in an internal audit, fixed before it ever affected a customer.
Widget protection
Your chatbot's embed key is visible in your site's source code, it has to be, to load the widget. What stops someone else from copying it and running your trained bot on their own site for free: a domain allowlist. Set which domains your widget is allowed to run on, and any other domain gets refused, even with a valid key.
Infrastructure hardening
- HTTPS enforced site-wide (HSTS, 2-year max-age, includes subdomains)
- Standard security headers on every response (prevents clickjacking and MIME-sniffing attacks)
- Rate limiting on signup, login, password reset, and public endpoints
- Every sensitive account action (signup, password reset, data changes) is logged
Is my data isolated from other Zenvi customers?
Yes. Every database query is filtered by your account ID through a shared access layer, not re-implemented per page, which is what actually prevents one customer's data from leaking into another's view.
Does Zenvi store my customers' credit card numbers?
No. Payments are processed by Creem, a payment processor, Zenvi never sees or stores raw card numbers.
Is Zenvi SOC 2 or ISO 27001 certified?
Not yet. Zenvi follows real security practices (password hashing, signed sessions, per-account data isolation, domain-restricted widget embedding, HTTPS enforcement) but hasn't completed a formal third-party certification. If that's a hard requirement for your organization, email support@zensebot.com and we'll tell you where things stand honestly.
How do I report a security issue?
Email support@zensebot.com. Real reports get read and acted on.
Build your bot free, your data is isolated from day one
No credit card, 50 messages for life.
Start free, no credit card