How we handle your data — honestly.

Security and privacy measures

• Encryption in transit

  The website, the chat widget and our API are served only over HTTPS, with HSTS on the API.

  Implemented

• Encryption at rest

  Our database host (Supabase) encrypts stored data at rest.

  Implemented

• Separate data for every customer

  Every chatbot, conversation, enquiry and document belongs to one customer, and the database itself rejects records that mix customers. Automated tests check this.

  Implemented

• No direct database access from browsers

  Customer data is reached only through our backend, which checks who you are and what you may see.

  Implemented

• Two-factor authentication for administrators

  Cailub staff must use an authenticator app to open administration tools.

  Implemented

• Rate limits and abuse protection

  Limits on chats, demos, sign-ins and forms, plus daily spending caps on AI use.

  Implemented

• You choose how long conversations are kept

  Website conversations are deleted after 90 days by default; you can change this for each chatbot.

  Implemented

• Clear AI disclosure

  Every chatbot says it is an AI assistant, and its replies are marked as AI-generated in a machine-readable way.

  Implemented

• No training on your data

  Your content is used only to answer for your own assistant. Our AI provider's commercial terms don't allow it to train its models on content we send.

  Implemented

• Public pages only for demos

  Demos read publicly accessible pages only, follow robots.txt and never get around blocks or logins.

  Implemented

• Export and deletion tools

  Download your data, find and erase a website visitor’s data, and ask us to close your account, from your dashboard.

  Implemented

• Audit log

  Administrative and security actions are recorded in a log that cannot be edited, kept for two years.

  Implemented

• Data breach response

  Incidents are logged as soon as they are found. A written response plan, including reporting to the ICO within 72 hours where required, is being finalised.

  In progress

• Independent security testing

  An external penetration test before we take on larger or regulated customers.

  Planned

Cailub does not currently hold security certifications. We will list them here only once verified.

Subprocessors

The full list, with the safeguards for transfers outside the UK, is in our Subprocessor Register.