Security
Businesses run their customer conversations, websites and ad accounts on Chataut AI. We build and operate the platform to protect that data, theirs and their customers'.
Security lead
Roberto Castillo, Tech Lead
Security at Chataut AI has a named, accountable owner.
Security lead
Tech Lead, Chataut Labs, Inc.
A computer and IT engineer specializing in cybersecurity, Roberto leads security for the Chataut AI platform and is the point of contact for vulnerability reports and security incidents.
These are the controls in place on the platform today, described in plain terms.
Sign-in is handled by Clerk, a dedicated authentication provider.
As a result, passwords for Chataut AI accounts are never stored on our servers. Administrative functions are restricted to authorized administrators.
Connecting an AI assistant to Chataut AI uses OAuth with PKCE and an explicit consent screen.
Access tokens are short-lived, valid only for our MCP server and stored only as keyed hashes. You can revoke a connection at any time from your account settings, and organization membership is re-checked on every request. When an assistant asks to buy or renew a domain, or to create a business mailbox, the charge is made only after the user approves it inside Chataut AI.
Our website, app and API are served only over HTTPS.
Plain HTTP requests to them are redirected to HTTPS, and our API sends HSTS. Customer websites, on chatautai.com subdomains or on their own domains, get TLS certificates automatically.
Our database runs on Supabase's managed PostgreSQL, which encrypts all data at rest with AES-256.
On top of that, the application itself encrypts certain secrets with AES-256-GCM and versioned keys, including the access tokens for the Facebook, Instagram and Meta Ads accounts connected for publishing and ad management, and business mailbox passwords.
Card details are entered directly into the secure payment forms of Stripe and our other payment providers.
Card numbers never reach our servers, and we never store them.
Production servers sit behind a cloud firewall and a host firewall that open only the ports each service needs.
Internal application and cache ports are not reachable from the internet. The web app and customer websites on chatautai.com subdomains are served through Cloudflare, and both our API and all customer websites enforce per-IP rate limits.
New versions of our app and API reach production through our CI pipeline.
Each version must pass health checks when it goes live; if it doesn't, the previous version is restored automatically.
Our backend sends automatic alerts on critical errors.
The app and API expose health checks that we verify on every release. Security incidents are handled by our security lead, from containment through remediation and follow-up.
Webhooks from Stripe, our other payment providers and Clerk are verified by their cryptographic signature.
If the signature can't be verified, the request is rejected before we process it.
Websites hosted by Chataut AI, on chatautai.com subdomains or on customers' own domains, are stored as structured content blocks validated against a strict schema.
AI fills in the content but never writes the HTML or code we serve: all text is escaped when the page is rendered, and pages are served with a strict Content-Security-Policy that allows only the scripts our renderer generates.
We welcome reports from security researchers and anyone who finds a potential vulnerability in Chataut AI. If you act in good faith and follow this policy, we will work with you to understand and resolve the issue quickly.
Email security@chatautai.com, in English or Spanish. Please include:
If you'd rather share details over an encrypted channel, email us first without the technical details and we'll arrange one.
We reply within 3 business days to confirm we received your report.
We share our assessment and keep you updated until the issue is resolved.
We prioritize each fix by severity and real-world impact, and tell you when it is deployed.
With your permission, we will publicly acknowledge your contribution once the issue is fixed.
We won't share your name or contact details outside Chataut Labs without your permission, unless the law requires it.
chatautai.com, www.chatautai.com
Public website
ecommerce.chatautai.com
Chataut AI web application
api.chatautai.com
Platform API
Customer sites on *.chatautai.com
Only the Chataut AI platform that serves them (routing, TLS and page rendering)
Not sure whether something is in scope? Ask us before you test it.
We consider security research conducted in good faith and in accordance with this policy to be authorized, and we will not initiate or support legal action against you for it, including for accidental, good-faith violations of this policy. We waive, on a limited basis, the restrictions in our Terms of Service (including the Acceptable Use Policy) that would otherwise prevent such research. This authorization covers only the systems listed as in scope: we cannot authorize testing of third-party systems or services, and you remain responsible for complying with all applicable laws. If a third party takes legal action against you for activities that complied with this policy, we will take reasonable steps to make it known that you acted in compliance with this policy. If in doubt, contact us before going further.
We don't currently run a paid bug bounty program. With your permission, we will publicly acknowledge researchers who report valid vulnerabilities to us.
Send security reports and questions to this address, in English or Spanish.
