Security

All data is encrypted in transit with TLS 1.3 and encrypted at rest on our managed database (Supabase). Traffic to connected channels and AI providers is encrypted end to end on the wire.

Channel access tokens and other secrets are stored in Supabase Vault, encrypted at the column level and never exposed to the client or in logs.

Every incoming webhook from Meta (WhatsApp, Instagram, Facebook Messenger) and Stripe is verified with HMAC signature checks before it is processed, so forged or tampered requests are rejected.

Authentication is handled by Supabase Auth. Passwords are hashed with bcrypt — we never see or store plaintext passwords.

Every table in our database enforces Row Level Security, giving each workspace strict multi-tenant isolation at the database layer — not just in application code. One account can never read another's data.

We use PostHog's EU instance, with session recording disabled and cookieless tracking until you consent. See our Privacy Policy and Cookie Policy.

Sensitive endpoints (auth, billing, webhooks, AI calls) are rate-limited to protect against abuse and brute-force attempts.

The codebase goes through a dedicated security review at every major release — covering authentication, authorization, input validation, and the OWASP Top 10.

We use Sentry for error monitoring, configured to scrub PII from events. Uptime is tracked continuously and published on our status page.

• SOC 2 — planned for v1.2.
• Bug bounty program — planned. Until then, please report responsibly (below).

Found a security issue? Email security@xyrachat.com and we'll respond quickly. A PGP key for encrypted reports will be published here (coming soon). Please give us a reasonable window to fix before any public disclosure.