[ Security ]
Built to be trusted
with your inbox.
What we do to protect the accounts you connect and the conversations that pass through them — stated plainly, with nothing we cannot back up.
[ Safeguards ]
How your data
is protected.
Encryption everywhere
Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256.
Protected credentials
The access tokens that link your Meta, Google and TikTok accounts are encrypted separately, are never shown in the app, and are revoked and deleted when you disconnect.
Workspace isolation
Each customer’s data is logically separated, and every request is checked against the workspace it belongs to.
Least-privilege access
Only staff who need production access to do their job have it, with multi-factor authentication, and their access is logged and reviewed.
Minimal permissions
We request the narrowest platform permissions that a feature needs, and you choose which Pages, mailboxes, calendars and sheets are connected.
Monitoring and testing
We log security-relevant events, patch dependencies, and test our systems for vulnerabilities.
Backups and recovery
Data is backed up in encrypted form and restoration is tested.
Vetted providers and people
Sub-processors are assessed before we use them, and everyone with access to data is bound by confidentiality obligations.
[ Connected accounts ]
Access you give,
and can take back.
Meta, Google and TikTok each review how we handle their users’ data. This is what that means for you.
Official APIs only
Every channel is connected through the platform’s own API. No browser extensions, no scraping, no unofficial automation.
We never see your password
You sign in on Meta’s, Google’s or TikTok’s own screen. We receive a token that you can revoke at any time.
Only the permissions a feature needs
You choose which Pages, mailboxes, calendars and sheets are connected, and nothing else is read.
Google data stays within Limited Use
Gmail, Calendar and Sheets data is used only for the feature you see — never for advertising, and never to train general AI models.
[ Your controls ]
You decide what is sent,
kept and deleted.
Approval mode
Have every reply wait for your OK until you trust what the agent says.
Guardrails you set
Decide what an agent may promise, discount, refund or book on its own.
Human handoff
Low confidence or an unhappy customer moves the chat to a person, with the history attached.
No training on your data
Your conversations are not used to train shared or general-purpose AI models.
Export any time
Take your conversations and contacts with you whenever you like.
Real deletion
Deleted data leaves live systems within 30 days and backups within 90 days.
[ If something goes wrong ]
You hear it from us, within 72 hours.
If we become aware of a breach affecting your data, we tell the account owner without undue delay and in any case within 72 hours: what happened, what data was involved and what we are doing about it. We then help you meet your own obligations to regulators and customers.
No online service can guarantee absolute security, and we will not claim to. We commit to the safeguards on this page, to improving them, and to telling you plainly if they fail.
[ Report a vulnerability ]
Found a problem? Tell us first.
Write to hello@compenra.com with the subject “Security report”, the affected page or feature, and the steps to reproduce it.
- We aim to reply within three business days and keep you updated until it is fixed.
- We will not take legal action against research done in good faith under these rules.
- Please do not access other people’s data, disrupt the service, or share the issue publicly before we have fixed it.
Machine-readable contact: /.well-known/security.txt
[ Documents ]
Everything in writing.
Read them here or download a PDF for your records. We operate SOC 2 Type II controls. For a security questionnaire or a countersigned DPA, write to hello@compenra.com.
[ Join 500+ teams ]
Your next customer
already messaged you.
Put the agent live on one channel in 10 minutes and watch what comes back by tomorrow morning.