Security at ConvChat

ConvChat runs entirely on managed, professionally operated infrastructure: the backend, database and core chat data run in Convex Cloud’s EU West region in Ireland, and the website, dashboard and chat widget are served by Vercel. Vercel Functions are configured to execute in Frankfurt, Germany (fra1), while static assets are served through Vercel’s global edge network. We operate no servers of our own, which keeps the attack surface small and patching in the hands of teams who do it full-time.

All data is encrypted in transit with TLS — between the widget and our backend, between the dashboard and our backend, and between our backend and every subprocessor. Core backend data is encrypted at rest with AES-256; other data at rest is encrypted by the relevant managed infrastructure provider. Browser push notifications to agents are end-to-end encrypted (Web Push standard), so push relay services cannot read their content.

ConvChat is multi-tenant with strict workspace isolation: every read and write in the backend is scoped to the authenticated agent’s workspace, enforced in the data layer on every query — not as an afterthought in the UI. Agents authenticate with individually invited accounts; widget sessions are scoped to a single project, and projects can restrict the widget to an allowlist of domains. Internally, access to production data is limited to the small team that operates the service, on a need-to-know basis.

We store the minimum we need. The clearest example: visitor location shown to agents (country and city) is derived from the IP address at the network edge, and the raw IP address is never stored. Customers can switch off visitor geolocation per project entirely.

Our own product analytics run on PostHog’s EU Cloud in Frankfurt, Germany — cookieless, without session replay on marketing pages, and proxied through our own domain. Details and an opt-out are in the Privacy Policy.

We use a deliberately short list of subprocessors, published with purposes and locations:

Processor terms — including breach notification, deletion on termination and audit rights — are in our Data Processing Agreement, which applies to every customer automatically.

ConvChat is built and operated in Switzerland under the Swiss nFADP and the GDPR. We do not yet hold formal certifications such as SOC 2 or ISO 27001 — we would rather tell you that plainly than imply otherwise. Our core infrastructure provider is independently audited under SOC 2 Type II and contractually supports GDPR processing through a DPA and Standard Contractual Clauses. We are happy to answer security questionnaires; write to us at the address below.

If you believe you have found a security vulnerability in ConvChat, please report it to contact@appik-studio.com with enough detail to reproduce it. We will acknowledge your report promptly, keep you informed while we fix it, and will not take legal action against good-faith research that avoids privacy violations and service disruption.