Security
How we protect your data
Your customer conversations are some of the most sensitive data your business holds. Here is how EasyFastAI is built to keep them safe.
Encryption in transit
All traffic between your browser, the EasyFastAI API and our data stores runs over TLS. The embeddable web widget is served over HTTPS and talks to our API on the same encrypted channel.
Authentication
Accounts are backed by Google Firebase Authentication, including email verification and Google sign-in. API requests are authorised per request with short-lived identity tokens, and server-side sessions are validated on every protected endpoint.
Tenant isolation
Every instance, conversation, contact and widget is scoped to the account that owns it. Authorisation is enforced on the server for each request rather than relying on the interface to hide data.
Widget hardening
Embedded chat widgets run inside a sandboxed iframe and only accept messages from origins you explicitly allow. Assistant responses are sanitised before rendering, so a reply can never inject scripts into your website.
Abuse protection
Public endpoints — the contact form, widget chat, voice transcription and provisioning — are rate limited. Standard security headers are applied, and uploads are size-capped and type-checked.
Your data, your control
You can export your CRM contacts at any time, and deleting your account removes your instances, conversations and widgets. See our GDPR page for data-subject requests.
Reporting a vulnerability
If you believe you have found a security issue, please email security@easyfastai.com with steps to reproduce. We will acknowledge your report and keep you updated while we investigate. Please give us a reasonable window to fix the issue before disclosing it publicly.