Get it free
Legal

Security

Infrastructure

The service’s functions run on Vercel in the EU (Frankfurt, fra1); Vercel’s network receives each request at the point nearest the visitor. The database is Supabase Postgres in the EU (AWS eu-west-1, Ireland). OpenAI (conversation understanding and speech-to-text) and Resend (delivery of request emails) process in the United States under the 2021 Standard Contractual Clauses. The full list is Appendix B of the Typelessity DPA.

Encryption

  • TLS on every connection the service receives and makes: browser to service, service to database, service to each sub-processor. A booking endpoint must be an https:// URL; plain http:// is refused.
  • Database encryption at rest as provided by the database platform. Integration secrets you store carry a second, application-level AES-256-GCM encryption.
  • API keys are stored only as hashes; the plaintext key is shown once, at creation.
  • A Content-Security-Policy header, HSTS and X-Frame-Options DENY on all pages of this site.

Access control

  • Configurations, conversations and results are isolated per organisation, and every request is authenticated per organisation.
  • The administrative consoles of our providers are reachable only by the proprietor, each behind an individual account.

Backups

  • The service runs on the free tiers of its hosting and database providers. On those tiers there are no automatic backups and no point-in-time recovery; what exists is a database export taken by hand.
  • Before the widget is first installed live on a customer's site, or before the first invoice — whichever comes first — both platforms move to plans with automatic daily backups.

Vulnerability management

  • Automated tests run on every change; changes that touch a security boundary carry tests verified to fail when the protection is removed.
  • Security reports: info@webappski.com.

Compliance

You are the controller and Typelessity is your processor under the DPA (GDPR Article 28). Who processes what, where and on which transfer basis is on the /gdpr page; the limits above are stated in Appendix A of the Typelessity DPA.