Security at Asks

• In transit: all traffic between your browser, the widget, our API, and our providers uses TLS 1.2 or higher.
• At rest: databases and file storage are encrypted at rest by our infrastructure providers.
• Application-layer encryption: the most sensitive values — channel access tokens, integration credentials, webhook signing secrets — are additionally encrypted with AES-256-GCM before they ever reach the database.
• Hashing: account passwords are hashed with bcrypt; API keys are stored only as SHA-256 hashes and can never be recovered, only rotated.

• Role-based access: owner, admin, and member roles are enforced server-side on every workspace operation.
• Two-factor authentication for every account, with recovery codes.
• SAML single sign-on for enterprise workspaces, with domain-verified just-in-time provisioning, enforced-SSO mode, short session lifetimes, and a full SSO audit log (sign-ins, configuration changes, break-glass access).
• Scoped API keys with per-key permissions, last-used tracking, and instant revocation.

Every record in Asks is scoped to a workspace, and that scoping is enforced on every query at the application layer. Your AI agent's knowledge lives in a dedicated vector-index namespace per workspace— one customer's AI can never retrieve from another customer's knowledge base. Deleting a workspace cascades through the database, file storage, search indexes, and vector indexes.

• Every inbound webhook — Stripe, Shopify, WhatsApp, Instagram, Facebook, Slack, Telegram, email — is verified with the provider's cryptographic signature, using constant-time comparison
• Outbound webhooks to your systems are signed with HMAC-SHA256 so you can verify us the same way
• The chat widget uses signed session tokens so a conversation can only be read by the browser that started it, plus per-workspace origin allow-listing
• Rate limiting and request idempotency protect the public API

• No cross-customer training: your data trains nothing that serves anyone else. Answers are generated with retrieval-augmented generation from your own content.
• Groundedness checks: AI responses are judged against your knowledge base, and fabricated links are stripped before sending.
• Abuse detection: automated detection stops bot-loops and abusive conversations from burning your resources.
• Human handoff: escalation to your team is always available — by AI judgment, business-hours rules, or the customer's request.

• Raw visitor IP addresses are not stored on conversations — only a derived country code
• Error reports are scrubbed of email addresses and IP addresses before they leave our systems
• Secrets are redacted from logs, including credentials used by your custom actions
• Time-boxed data (like store browsing events) is purged automatically after 30 days

• Managed, encrypted database backups with point-in-time recovery
• Centralized error and performance monitoring with alerting
• Startup-time validation that refuses to boot production with weak or missing secrets
• Live service status at status.asks.app, with incident history

Incident response

If a security incident affects your data, we notify you without undue delay with the details you need for your own compliance obligations — see our DPA and GDPR page.

Asks is GDPR-ready: a self-serve DPA with EU Standard Contractual Clauses, a public subprocessor list with advance change notice, built-in deletion and export tooling, and automatic handling of platform data-deletion requests (Shopify redaction webhooks, Meta deletion callbacks). We conduct recurring internal security audits across the platform and are evaluating third-party attestations as we grow. For our full compliance posture, control inventory, and answers to common security-review questions, visit the Trust Center.

Found something? We want to know. Email security@asks.app with reproduction details. We acknowledge reports quickly, keep you informed while we fix, and never take legal action against good-faith research.