Security

Your customers' data. Handled carefully.

Two-factor sign-in, team roles, an audit log, PII scrubbing, retention you control, and approval rules on every AI action. Hosted on AWS, encrypted in transit.

Last reviewed Oct 1, 2026

Ask a security question Browse trust documents
Two-factor sign-in
Emailed code at sign-in
Live
PII scrubbing
Transcripts & summaries
Live
Hosted on AWS
Encrypted in transit
Live
SSO · SOC 2
Not available yet
On our roadmap

How we protect your data

Four layers. Always on.

Sensitive details scrubbed from what we store. Consent and calling rules enforced on every call. Tight control over what the AI may do, and over what each person on your team may do.

Data protection

Keep less. Expose nothing.

Aiva Chat scrubs personal details out of transcripts and summaries — card numbers, SSNs and dates of birth, plus any terms you add yourself. What you read in the dashboard is what you'd be comfortable keeping.

You decide how long conversation data is kept — retention is a setting on your account, not a fixed policy. Call recordings play back through short-lived links, so a copied URL stops working.

HostingAWS
In transitEncrypted
PII scrubbingTranscripts + summaries
RetentionYou set it per account
In transitEncrypted — dashboard, widget and webhooks
TranscriptsPII scrubbed — cards, SSNs, dates of birth
SummariesSame scrubbing + your own terms
RecordingsShort-lived playback links
RetentionYour schedule — set per account
Consent & calling rules

Callers always know. Opt-outs always stick.

Before any call is recorded, Aiva Chat plays a spoken recording notice. Texts honour STOP and START automatically, and anyone on your do-not-contact list is skipped — on calls, texts and campaigns.

Outbound campaigns only dial inside a calling-hours window (8am–9pm), and outbound messages pass content safety checks before they go out.

Recording noticeSpoken, before recording
Opt-outsSTOP/START + do-not-contact list
Campaign calling hours8am–9pm
Recording notice
Spoken to the caller before any recording starts
Voice
Do-not-contact list
Checked before every outbound call and text
All channels
STOP / START
Opt-out and opt-back-in handled automatically
SMS
Calling-hours window
Campaigns only dial between 8am and 9pm
Campaigns
Access & AI controls

Tight controls. Including on the AI.

Turn on two-factor and every sign-in asks for a one-time code sent to your email. The audit log records sign-ins, setting changes, deletions and exports, with who did it and when. Nobody can edit or delete an entry.

You choose what the AI may do on its own. Each action can run automatically, ask first (it waits in an approval queue) or never. Webhooks are signed with secrets you can rotate, and incoming Twilio requests are signature-verified.

Sign-inTwo-factor (emailed code)
AI actionsAutomatic · ask first · never
WebhooksSigned · rotatable secrets
Web widgetDomain allowlist
Two-factor sign-in
A fresh emailed code on every sign-in once it's on
Live
Audit log
Logins · setting changes · deletions · exports
Live
Approval controls for AI actions
Automatic, ask first or never · approval queue
Live
Signed webhooks
Secret rotation · Twilio request-signature verification
Live
Widget domain allowlist
Your chat widget only loads on sites you approve
Live
Team access

Everyone signs in as themselves.

Invite your team as Admin, Staff or Viewer. Each person has their own sign-in and sees only what their role allows, checked by the server on every request. Billing, your OpenAI, Stripe and Twilio keys, API keys and your account stay with you, whatever the role.

Turn on Require a sign-in code for my team and every member gets an emailed code each time they sign in. Remove someone and they lose access straight away, even on a page they have open. Every change a member makes is listed on the Team page, and their sign-ins go into the audit log.

RolesAdmin · Staff · Viewer
Sign-inOwn password · code can be required
Removing someoneTakes effect on their next click
Owner onlyBilling · keys · account
Admin
Everything except billing, keys and your account
Can change
Staff
Calls, inbox, contacts and bookings · can be limited to their own bookings
Day to day
Viewer
Looks at calls, messages, bookings and reports
Look only
Require a sign-in code for my team
A 6-digit code by email at every team sign-in
Optional

Security specifications

The details your security team wants.

Specific controls, all live in the product today.

Approval modes
3
Automatic, ask first or never — per action, with an approval queue.
Signed webhook events
26
Delivery log, retries, test events and secret rotation.
PII scrubbed
3+
Card numbers, SSNs and dates of birth — plus any terms you add.
Campaign calling window
13hr
Outbound campaigns only dial between 8am and 9pm.

Guardrails

The never list.

Guardrails built into the product, not promises on a slide.

Aiva Chat never records a call without telling the caller.
A spoken recording notice plays before any recording starts. No silent recording.
Aiva Chat never contacts someone who opted out.
STOP is honoured automatically, and your do-not-contact list is checked before outbound calls, texts and campaigns.
Campaigns never dial outside calling hours.
Outbound campaigns are held to an 8am–9pm calling window.
The AI never takes an action you've switched off.
Set any action to never, or to ask first so it waits in your approval queue. You stay in charge of what it does.
Outbound messages never skip a safety check.
Outbound content passes safety checks before it reaches your customers.
Your team never needs your password.
Each person signs in as themselves, and no role can reach your billing, your OpenAI, Stripe or Twilio keys, or your account.
A removed team member never keeps access.
Removing someone takes effect on their next click, even if they're still signed in. Their past changes stay in the history.
We never charge extra for security features.
Two-factor sign-in, team roles, the audit log, PII scrubbing and approval controls are on every account. Every plan includes them — see /pricing.

Trust documents

Read the paperwork.

Public documents anyone can read. Have a security questionnaire? Email it to us.

Privacy Policy

What we collect, how we use it, and your rights as a data subject.

Read

Data Processing Addendum

The terms that govern how we process personal data on your behalf.

Read

GDPR

How we handle GDPR data-subject rights and requests.

Read

Sub-processors list

The third parties we use to run Aiva Chat, what they receive and where they're located.

Read

Terms of Service

The agreement that covers your use of Aiva Chat.

Read

Security questionnaire

Doing vendor diligence? Send us your questionnaire and we'll fill it in.

Email

Direct line

Talk to our security team.

Real humans. Real responses. For security questions, you reach us directly.

Security & vulnerability reports

Email support@aivachat.io

For security questionnaires, vendor reviews, DPA questions, or anything else security-adjacent. Vulnerability reports (responsible disclosure) go to the same address — please include “[VULN]” in the subject.

Email security team Book a call

Diligence done. Try it free.

Start with a 14-day free trial. No card. Questions first? Email our security contact.

Get started free Talk to sales