Our Security page is the overview. This page is the short version, plus what you can do yourself.
Your data#
- Connections to tufu are encrypted (HTTPS).
- Files you upload are stored privately, encrypted at rest, and open only through links that expire.
- The AI keys you add, and the access tokens for the tools you connect, are stored encrypted. AI keys are only ever shown masked (see Bring your own model).
- A bot you mark private answers only signed-in members of your team, in the chat and in the Ask console.
- Your card number goes straight to our payment processor. We never see it or store it.
Your visitors' conversations#
- Our AI providers don't train on your docs or your visitors' conversations. With your own AI key, your own agreement with that provider applies.
- When a visitor pastes a link, the bot can read that public page, treating it as information and never as instructions.
- Usage limits stop a script or a runaway bot from using up your answers (see Usage limits).
Signing in#
- New accounts confirm their email address before they can sign in.
- Turn on two-factor authentication on your Profile, under Two-factor authentication. Use an authenticator app, and keep the recovery codes somewhere safe.
- We email you when your password, email address or two-factor settings change. If you didn't make the change, reset your password and tell us.
Deleting data#
A team admin can delete the whole team under Settings → Team → Delete team, typing the team's name to confirm. Its bots, knowledge, files and conversations are deleted, its subscription is cancelled and its saved card removed. More in Your account and data. Deleted data also leaves our backups as they expire.
To delete your account, email us from your account's address:
Security reviews and questionnaires#
Need answers for your own security review? Send your questionnaire or your questions to .
Reporting a problem#
Found a security problem in tufu? Read the disclosure policy and email us with "Security" in the subject.