Security at OU Chat

Encryption

All traffic is encrypted in transit with TLS 1.3. Data at rest is encrypted with AES-256. Secrets and API keys are stored in a managed secrets vault, never in application code.

Data ownership & no model training

You own the content you connect and every conversation your agent has. Snippets are sent to LLM providers only to generate answers, under contracts that prohibit training their models on that data. We do not sell your data.

Access control

Access to production systems is least-privilege and role-based, protected by SSO and multi-factor authentication for our team. Within your workspace, you control who can see and manage each agent.

Infrastructure

The platform runs on reputable cloud providers with network isolation, automated patching, and continuous monitoring. Backups are encrypted and tested.

Reliability

We monitor availability continuously and design for graceful degradation so your agent keeps answering. Enterprise plans can include an uptime SLA.

Data retention & deletion

You can delete individual sources or conversations anytime. On account closure we delete or anonymize your data within 30 days unless a longer period is legally required.

Sub-processors

We use a small set of vetted sub-processors (hosting, LLM inference, analytics, email, payments), each under a data-processing agreement. A current list is available on request.

Responsible disclosure

Found a vulnerability? Please report it privately to security@ou.chat. We investigate every report and will work with you on a fix; we ask that you give us reasonable time before public disclosure.

What the agent can see

The agent reads the sources you connect and the conversation it is having. It does not read your visitors' other browsing, and the widget does not track people across sites. Where a visitor identifies themselves, whether an email for a transcript or a phone number for a callback, that is stored against the conversation in your workspace and nowhere else.

Voice calls are transcribed so you can review them. Recordings and transcripts live in your workspace under the same retention rules as chat.

What we do not have yet

We would rather tell you than let a procurement process discover it late. OU Chat does not currently hold SOC 2, ISO 27001, or a HIPAA BAA. Everything on this page is a practice we follow, not a certification a third party has audited.

If your procurement needs one of those, say so early and we will tell you honestly whether we can meet the timeline rather than starting a process we cannot finish.

Compliance

We build to align with GDPR and CCPA obligations and offer a Data Processing Addendum. If your procurement process needs specific documentation, contact security@ou.chat and we'll help.