Security

The answers your IT team will ask for

What is in place, how it works, and — further down — what is not. TalkZen would rather lose a deal than be vague about this.

Signing in

Two-factor authenticationAny authenticator app, with one-time recovery codes.
Single sign-onGoogle, Microsoft, or any OpenID Connect provider.
Password rulesLength, letters and digits, no common passwords, not your own email.
Account lockoutRepeated wrong passwords lock the account for fifteen minutes.
Access restrictionLimit the dashboard to your office network, by address or range.

Encrypted secretsChannel tokens, SSO secrets and app keys are AES-256-GCM encrypted at rest.
Card maskingA card number typed into a chat is masked before it is ever written down.
Workspace isolationOne workspace can never read another's data. Checked on every route, in every test run.
Export and deletionTake your data out, or have it removed, whenever you ask.
Nightly backupsAutomatic database backups on self-hosted installs.

Audit logWho signed in, who changed what, and when.
Health endpointDatabase, memory and error counts, for your own monitoring.
Failed sign-in alertsA rising number of failures emails the owners.
Rate limitingPer address, on sign-in, registration and the widget.
Outbound request guardWebhooks and imports cannot be pointed at internal addresses.

If any of these is a requirement for you, say so before you start a trial and we will tell you where it stands.

SOC 2 / ISO 27001
Not certified. The controls are in place; the audit is not done.
EU data residency
Choose your own region on a self-hosted install; not offered as a managed option.
HIPAA
No BAA available. Do not put protected health information in chats.

Found something that looks wrong? Tell us — we would rather hear it from you than from a customer.

Start a trial, or send your security questionnaire over and we will fill it in.

No card needed Set up in 5 minutes Cancel any time