Security
Security you can check
tufu holds your docs, your customers' conversations and the credentials for the tools you connect. We build the service to protect them. This page is an overview; for anything more, write to us.
-
Encrypted
Data is encrypted in transit and at rest.
-
Separated by team
Each team's data is kept apart from every other team's.
-
Never used for training
Our AI providers don't train on your docs or your visitors' conversations.
-
Yours to delete
Team admins can delete conversations, or the whole team, at any time.
Infrastructure
Where tufu runs.
-
Hosted in the US
The app and its database run with established cloud providers in the United States.
-
Encrypted on the way
Connections to tufu use HTTPS, and plain HTTP is redirected.
-
Files kept private
Files you upload are stored privately, encrypted at rest, and open only through links that expire.
-
Backed up
The database is backed up on a regular schedule.
Your data
Your docs, files and keys.
-
Credentials are encrypted
The AI keys you add and the access tokens for the tools you connect are stored encrypted. AI keys are only ever shown masked.
-
Walled off by team
Everything your team adds belongs to your team, and its pages check that you're a member before showing anything. The only pages anyone can open are the ones you publish, like a public bot's chat.
-
Kept to your team
A bot you mark private answers only signed-in members of your team.
-
Delete it yourself
A team admin can delete the team at any time, with its bots, knowledge, files and conversations. To delete your account, ask us.
-
Card details stay with our payment processor
Your card number goes straight to our payment processor. We never see it or store it.
Your customers' data
What your visitors tell your bot.
-
No training on it
Our AI providers don't train on your docs or your visitors' conversations. With your own AI key, your own agreement with that provider applies.
-
Kept as long as you choose
Conversations stay until you delete them, or a team admin can have them deleted after 30, 90 or 365 days without a new message.
-
One visitor's data, on request
When a visitor asks, a team admin can delete every conversation they had with your bots.
-
Visitor details go with the conversation
The details a visitor leaves in your lead form are kept with their conversation and deleted with it.
-
Consent, as it was asked
When your lead form asks for marketing consent, tufu keeps the answer as given: ticked or not, the exact wording the visitor saw, and when.
-
Signed webhooks
Requests tufu sends to your webhook addresses are signed, so your tools can check they came from tufu.
Accounts
Signing in to tufu.
-
Confirmed email first
New accounts confirm their email address before they can sign in.
-
Two-factor for any account
Anyone can turn on two-factor authentication with an authenticator app.
-
Told when it changes
We email you when your password, email address or two-factor settings change.
-
Admins hold the keys
Only a team's admins can change its billing, integrations, AI keys and members, or delete it.
How we work
Built with care.
-
Tested before release
Changes go through automated checks before they are released.
-
Watched in production
We monitor the running service so problems are found and fixed quickly.
Providers
Who helps us run tufu.
-
Providers, by kind
We use a small set of providers for hosting, AI models, email, network security and payments. The Subprocessors page lists the kinds and what each does, and we send the full list on request.
-
GDPR terms in writing
Our Data Processing Addendum covers GDPR Article 28, with the EU Standard Contractual Clauses and the UK and Swiss terms for data that leaves the EEA.
Security reviews
Doing a review?
Send your questionnaire or your questions to .
Report a vulnerability
Found a problem? Tell us.
Email with “Security” in the subject.
Questions
What security reviews ask us.
Do you train AI models on my data?
No. Our AI providers don't train on your docs or your visitors' conversations. With your own AI key, your own agreement with that provider applies.
Where is my data stored?
In the United States, with cloud providers. The kinds of provider we use are on the Subprocessors page, and we send the full list on request.
Can I delete my data?
Yes. A team admin can delete one visitor's conversations, have conversations deleted after 30, 90 or 365 days without a new message, or delete the whole team at once. Deleted data also leaves our backups as they expire.
How do I report a security problem?
Email us with "Security" in the subject. The details are in our disclosure policy.
The fine print