Security

How CitraChat protects your customers' data

Your data stays in Brazil, is encrypted in transit and at rest, each account only sees its own data, and support has a backup AI route so it never stops. This page lists, plainly, what we do and what is still in progress.

Data checked on October 21, 2026

Where your data lives

• Database in São Paulo. The main database runs on Supabase, in the sa-east-1 region, in Brazil.
• Processing in São Paulo. The functions that serve the website, the widget and WhatsApp run on Vercel, in the São Paulo region. A conversation does not cross the ocean to be answered.
• Declared subprocessors. Anthropic (AI model), Vercel (hosting), Resend (email) and Stripe (billing). The full list, with each one's region, is in the privacy policy.

Encryption and access

• In transit. All traffic uses TLS, and the site enforces HTTPS permanently (HSTS).
• At rest. The database and uploaded files are encrypted at the provider.
• Integration credentials. Access tokens for Google Calendar and WhatsApp are stored encrypted and never appear in the dashboard.
• Dashboard access. Email and password authentication, with the session validated on the server on every request. Teams have distinct roles, and each person signs in with their own account.
• Isolation per account. Database tables have row-level access rules: one account cannot read another account's data, not even by mistake.

Verified integrations

• WhatsApp through Meta's official API. No unofficial API, which puts your number at risk of being blocked. Messages arriving from WhatsApp have their signature checked before being processed.
• Google Calendar verified by Google. The integration went through Google's verification and reads only free and busy times. We do not store the content of events.

The AI that answers for your customers

• Declared model. The agents use Claude, from Anthropic. You know which AI is talking to your customer.
• Not used for training. Conversations are not used to train AI models.
• The knowledge base is the rule. When the agent has a knowledge base, answers about what it covers come from it. Prices, deadlines and numbers are not made up.
• Backup AI route. If the main API becomes unavailable, a backup route with the same models, on another provider, takes over the conversation. And if no route responds, the agent says it is unstable, records the visitor's contact and notifies the team. No lead is lost.

Service protections

• Usage limit per origin. The chat, training and file upload routes have request limits, which blocks abuse and scripts.
• Security headers. The dashboard cannot be embedded in third-party sites, and the site sends the recommended protection headers.
• Payment without storing cards. Billing is handled by Stripe. CitraChat never sees or stores card data.
• Cookie consent. The site only enables analytics and marketing with your permission, with refusal as the default in Europe.

Your rights over your data

• LGPD and GDPR. The privacy policy has versions for Brazil and for Europe.
• Retention. Data is kept during the contract and for up to 90 days after cancellation. Early deletion can be requested at any time.
• Export and deletion. Requests by email to contato@citra.chat, with a reply within 15 days.

What is still in progress

We would rather say what is missing than promise what does not exist. Today we do not have our own backup policy beyond the one offered by the database provider, and we do not have an independent security certification. Both are on our roadmap. If your company needs a data processing agreement or an SLA, write to contato@citra.chat.

Found a vulnerability?

Write to contato@citra.chat with the subject "Security". We reply to every responsible report and keep you updated on the fix.

Frequently asked questions