Security at Bugalou
Your customer conversations should be safe. Here you can read where your data is, how we protect it and which services we use for that.
Where your data is
- The database is at Neon in Frankfurt (Germany)
- The application runs on Vercel in the same region
- For some parts we use services outside the EU, such as OpenAI for AI answers, Resend for email and Twilio for telephony
Login and access
- Passwords are stored hashed with bcrypt
- Two-step verification is available
- Login is temporarily blocked after repeated failed attempts
- Roles per user within your organisation
- Our support team only looks along when you give permission
Encryption
- All data traffic goes over HTTPS
- Integration keys and other secrets are encrypted with AES-256
- Messages are not end-to-end encrypted: to show them in your inbox and create AI answers, Bugalou has to be able to read them
The website and platform
- A strict security policy (CSP) against harmful scripts
- Limits on the number of requests, against abuse
- Protection against bots on login and forms
- Error monitoring and a public status page
Your data, your choice
- Export the data of your organisation
- Set a retention period of 6 to 36 months
- A data processing agreement is available
- Payments go through Stripe, we do not store payment details ourselves
More information
A question, or found a security issue?
Email us at support@mail.bugalou.com