ChatRail security and data handling
API access
Use bearer tokens only from trusted server environments. Tokens should be scoped, revocable and excluded from source control, logs and client-side applications.
Webhook integrity
Verify signed webhook requests, reject stale or malformed events and process events idempotently.
Connection isolation
Credentials and linked-device sessions should be isolated per connection and encrypted at rest. Team access should follow least privilege.
Data minimization
Attach only the context required for a reply. AI processing remains optional, and customers should be able to choose retention and remove connection data.
Current status
ChatRail is live. Detailed production data-processing terms, subprocessors and operational commitments will be published before paid plans begin.