Security

Your business and your customers are in safe hands.

Your assistant talks to real customers about real things. Here is how we protect those conversations, written for people, not engineers. We also tell you plainly what we have not finished yet.

Last updated: October 2026

The short version

Three promises

Locked down

Conversations travel over secure connections, and the keys that connect your systems are stored scrambled so nobody can read them, not even the assistant.

Kept separate

Every business has its own space. One business can never see another business's chats, leads or documents.

You stay in control

Your team can read every conversation, step in at any moment, and decide exactly what the assistant is allowed to look up or do.

What we do today

Protection that is already in place

Each item below is live in the product now.

In place
Secure connectionsEverything between your visitors, your team and our servers is encrypted in transit.
In place
Your passwords and keys stay hiddenDatabase passwords, connection keys and meeting-tool keys are stored scrambled. Once saved, they are never shown again. The AI never sees them.
In place
Separate spaces for each businessYour data is tied to your business and checked on every request. Automated tests make sure businesses cannot reach each other.
In place
The right people see the right thingsOwners, admins and team members have different permissions. Only the owner can reveal a saved key, and must confirm their password to do it.
In place
Activity recordsWe log sign-ins and sensitive actions, such as someone viewing a saved key, so you can see who did what.
In place
The assistant looks, it doesn't changeWhen it checks your database it can only read. Anything that changes data, like a booking or a purchase, needs the customer to say yes first.
In place
Your website onlyThe chat widget works only on the websites you approve, and it is protected against automated abuse.
In place
Blocked from your internal systemsCustomer-entered connections cannot be used to reach private parts of our servers.
In place
A human can always step inYour team can watch any chat live and take over. Sensitive topics are handed over automatically.
In place
Hosted where you chooseWe run a separate set of servers per country. Canadian clients are hosted in Canada.
In place
Safe start-up checksOur servers refuse to start if essential security settings are missing or weak.

Honesty section

What we are still adding

We would rather tell you than let you find out. These are not finished, so please don't assume them.

In progress
Daily backups kept in your countryBackup tools are built and are being switched on and rehearsed for every deployment.
In progress
Hiding sensitive details from the AIAutomatically masking things like card numbers before a message reaches the AI model. Until then, the assistant asks visitors not to share sensitive details.
Planned
Two-step sign-inAn extra code when your team signs in.
Planned
Independent security testA specialist firm trying to break in, with a summary we can share.
Planned
Formal certificationWe do not hold SOC 2 or ISO 27001 today. We are happy to fill in your security questionnaire.
Planned
Always-on backup serversEach country currently runs on a single server, so we don't promise an uptime percentage yet.

About the AI

What happens when the assistant answers

What the AI receives

The customer's message, your assistant's instructions, the parts of your documents that matter for that question, and the result of any lookup. It does not receive your passwords or keys.

Who runs the AI

Today the answers are written with Google's Gemini service, on Google's paid business plan, which Google says does not use customer prompts to train its models. Google may process data outside Canada. See our Privacy page.

Can it go wrong?

Like any AI, it can occasionally be wrong. Prices come from your own systems rather than the AI's guess, and you can review every conversation. We recommend a supervised launch period.

Own AI or a Canadian-only option

Businesses that need it can use their own AI account, or an arrangement that keeps processing in a chosen region. Talk to us about what that needs.

Your part: use strong passwords, give team members only the access they need, and avoid collecting health, financial or children's information through the chat.

Security questions?

Send us your questionnaire or ask anything. We'll answer honestly, including the parts we haven't built yet.

info@optimalagents.ai