Controls around every conversation

Access to the platform and to customer data is authenticated and role-based.

• Users authenticate before reaching any customer workspace.
• Access is granted by role and limited to what a person needs for their work.
• API keys and access tokens are issued per customer and can be rotated.

Each customer's data, agents and credentials are separated from every other customer's.

• Customer workspaces are logically isolated from one another.
• Credentials belonging to one tenant are not accessible to another.
• Attempts to bypass credential isolation are prohibited and investigated.

Sensitive credentials are encrypted at rest and kept out of prompts and content fields.

• Certain sensitive credentials are encrypted at rest.
• Integration secrets are stored through credential-management mechanisms, not in prompts or application content.
• Customers are asked to keep API keys and tokens out of shared channels and data fields.

Authentication events, API activity and agent actions are recorded.

• Logs cover authentication events, API activity, application events and errors.
• Audit records support investigation, troubleshooting and accountability.
• Conversation outcomes are written back to your CRM as part of the record.

Technical and operational controls detect misuse and protect platform availability.

• Monitoring is used to detect abuse, fraud and security events.
• Access can be suspended or restricted where needed to protect the platform and its users.
• Security testing of the service requires prior authorization.

Defined processes for identifying, containing and communicating security incidents.

• NaviCS AI maintains processes for identifying and responding to incidents involving personal data.
• Customers are asked to report suspected unauthorized access promptly.
• Notification terms for your engagement are set out in your agreement.