Security
Security, described by mechanism.
EzyConn holds no security certifications. Rather than dress that up, this page describes what the product actually does — the checks that run, where they run, and what happens when they fail. You can hold us to every sentence.
How to read this page
Every claim below names the thing that enforces it.
There is no badge on this page, because we hold no certification. What there is instead: for each control, the mechanism that implements it and the point at which it is checked — so you can ask us to demonstrate it rather than take it on trust.
Where a control is missing, it is written down as missing. That list is at the bottom rather than buried, and it is the half of the page worth reading first.
Who can reach what
- One workspace cannot see another
- Every record that belongs to a workspace is scoped at the API on the way in — not filtered on the way out. A request for someone else’s conversation does not return an empty list; it is refused.
- Permissions are checked per action
- Roles decide what each person can do, and the check runs on the server for each action. Being an administrator does not skip it.
- Multi-factor authentication
- Available on accounts, enforced at sign-in when enabled.
- Erasure is enforced where it matters
- A deleted account is rejected at sign-in and at token refresh, not merely hidden from a list.
What happens to your data
- Third-party credentials are encrypted at rest
- Your Twilio auth token, your provider API keys and your channel credentials are stored encrypted, not in plain columns.
- Your provider key is yours
- Bring your own OpenAI, Anthropic or Google key and your traffic runs under your account and your agreement with that provider.
- Export and deletion on request
- Your data leaves in a readable format, and deletion is a real deletion.
- Subprocessors are published
- The list of services that touch your data is on its own page, kept current.
How the platform defends itself
- Server-side fetches are guarded
- Any time EzyConn fetches a URL you supply — crawling your site, calling your webhook — the destination is checked first, so the platform cannot be used to reach internal addresses.
- Webhooks are signed and verified
- Inbound webhooks from channel providers are signature-checked before anything acts on them.
- Rate limiting and spend caps
- Per-tenant limits on requests and on model spend, enforced on the streaming path as well as the ordinary one.
- Money operations are idempotent
- A retried payment or subscription request cannot double-charge.
- Limits are enforced against races
- Seat and workspace limits are checked under a database lock, so two simultaneous invites cannot both slip past a cap.
What the AI is and is not allowed to do
- A deterministic gate runs first
- On the website widget, every inbound message passes a fixed check before retrieval — no model call, about half a millisecond, on by default, and no setting turns it off. The same message always gets the same verdict, so a complaint can be reproduced months later.
- It refuses rather than improvises
- Requests for regulated advice, attempts to extract the system prompt or credentials, threats, and invitations to invent a commitment are declined with fixed wording that is never model-generated.
- Business rules are not model judgement
- Whether you cover a postcode, whether a phone number dials, and whether a time is free are deterministic checks. The model is never asked to decide them.
- Answers are grounded in your content
- Retrieval runs against your own documents and pages, with a relevance threshold — the agent declines rather than filling a gap.
- The gate covers the widget only
- WhatsApp, Telegram, Slack, Teams, email and the phone line do not run it. That is a real gap and it is on our list, not hidden.
What we do not hold.
A certification is a statement an auditor makes, not one a marketing page can make on their behalf. We have none, so we claim none.
- SOC 2 Type I or Type II — no audit completed
- ISO 27001 — not certified
- HIPAA — no BAA offered, and the health verticals are administrative only
- PCI DSS — not applicable; no card data is handled in a conversation
- SSO / SAML and SCIM — not built
- Data residency, regional hosting or multi-region deployment — none
- Self-hosted, private cloud or air-gapped deployment — none
- A published uptime SLA — none
Reviewing EzyConn for a regulated environment? Write to security@ezyconn.com and we will answer specifically rather than send a brochure. If a certification is a hard requirement today, we will tell you so.