Trust Center

AI Sales Assistant is built for Canadian small and medium businesses. We know you are trusting us with customer conversations, contact details, and appointment data. This page explains how we protect that information in plain language. For legal detail, see our Privacy Policy and Terms of Service.

Security overview

Enterprise-grade security with TLS encryption and modern browser security standards. We use industry-standard cloud providers, encrypt data in transit, and isolate each customer's data in our application.

• HTTPS everywhere — all dashboard and API traffic uses TLS encryption
• Security headers — HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Content-Security-Policy (enforced in production after smoke testing)
• Independent scans — SecurityHeaders.com grade A; Mozilla Observatory grade B+ (July 2026)
• Secure authentication — team sign-in via Clerk; multi-factor authentication (MFA) is supported
• Payment security — subscription billing handled by Stripe; we do not store full card numbers on our servers

Security scan notes

Independent scans in July 2026: SecurityHeaders.com grade A, Mozilla Observatory grade B+ (80/100). Both tools also show warnings about our Content-Security-Policy — expected tradeoffs for our stack, not silent oversights. Details below.

• Content-Security-Policy: our policy includes unsafe-inline and unsafe-eval in script-src. Next.js and Clerk require these today for sign-in, billing, and dashboard hydration. The rest of the policy still restricts scripts to approved domains (Clerk, Stripe, and our own origins). Removing these directives would need a larger nonce-based CSP rollout — on our security roadmap, not something we can flip overnight. Mozilla Observatory applies a −20 point penalty for the same reason (9 of 10 tests pass; overall grade B+).
• Cross-origin access (CORS): Access-Control-Allow-Origin: * is intentional on our public widget APIs (/api/chat and /api/widget-config) so the chat widget can run on your website. Protected dashboard APIs do not use a wildcard — they require an authenticated Clerk session. The scanner may also flag this header on public marketing pages; that does not expose customer data.
• SSL Labs (TLS scan): an Qualys SSL Labs run in July 2026 returned no grade — both Vercel edge IPs reported “Failed to communicate with the secure server.” That means SSL Labs' external probes could not complete a handshake from their datacenters, not that our certificate is invalid. HTTPS and TLS 1.3 work normally in browsers; we use a valid Let's Encrypt certificate on www.aisalesassistant.ca. This is a known limitation when testing Vercel-hosted sites from SSL Labs, not a customer-facing outage.

Encryption

• In transit: connections to our service use HTTPS (TLS)
• At rest: application data is stored in Neon (PostgreSQL) with encryption at rest provided by our cloud infrastructure
• Credentials: OAuth tokens (for example Google Calendar) and authentication secrets are stored securely and are not exposed in the dashboard UI

Access controls

• Dashboard access requires sign-in through Clerk
• Multi-factor authentication (MFA) — available to all team users through Clerk. Enable it under Settings → Security in the dashboard. We recommend MFA for organization owners and billing administrators; it is optional but supported today
• Customer data is scoped by organization — each business only sees its own leads, conversations, and settings
• Platform administration is separated from customer organizations
• Google Calendar access requires explicit OAuth consent from an authorized user in your organization

Organization members have role-based access. Owners manage billing and invitations. Managers can run day-to-day operations such as leads, appointments, team profiles, SMS, and follow-up, but cannot access billing or invite new members.

AI and your data

Website visitors chat with an AI assistant configured by your business. Here is what happens to that data:

• Conversations are processed through the OpenAI API to generate responses for your visitors
• Under OpenAI's API data usage policies, API inputs and outputs are not used to train OpenAI's public models by default
• We do not sell lead or conversation data to third parties for marketing
• Your business owns the lead data collected through your widget; we process it to operate the Service
• Indexed knowledge base content (your website pages, FAQs, documents) is used only to answer questions in your chat widget

See OpenAI API data usage policies and our Privacy Policy for more detail.

Data ownership and deletion

• Your business is the primary controller of lead data collected through your chat widget
• Team users can disconnect Google Calendar and update settings in the dashboard at any time
• Team users may contact us to request account data deletion, subject to legal and billing record requirements
• Website visitors should contact your business directly to request access to or deletion of information collected through chat

Cancelling your subscription: cancel through the Stripe customer portal (Settings → Billing). Paid features, including the website widget, stay active until the end of your current billing period. After that, the widget stops serving visitors; dashboard access and stored lead data remain unless you ask us to delete your account. See our Privacy Policy for retention details and plan downgrade behavior.

Infrastructure

AI Sales Assistant runs on trusted cloud infrastructure. Subprocessors include:

• Vercel — application hosting
• Neon — PostgreSQL database
• Clerk — authentication for team users
• Stripe — subscription billing
• OpenAI — AI chat responses
• Google Calendar API — meeting scheduling (when connected)
• Resend — transactional email
• Twilio — transactional SMS (when enabled)

Each provider processes data according to its own privacy policy and our agreements with them. See our Privacy Policy for the full list.

Data location

AI Sales Assistant is operated from Canada. If you access the Service from other regions, your information may be processed in Canada and in locations where our subprocessors operate (including the United States). See Privacy Policy — International users for details.

Backups

Database hosting through Neon includes provider-managed backups and point-in-time recovery capabilities. We rely on these infrastructure protections to help recover from accidental data loss or outages.

System status

Live service availability for the web application, database, and chat widget is published on our system status page. External uptime monitors also watch our health check endpoint for automated alerts. We do not publish historical uptime percentages until enough monitoring data exists — check the status page for current component health.

Privacy and compliance

• PIPEDA: we follow privacy practices aligned with Canadian personal information protection requirements
• GDPR / CCPA: where applicable, rights and disclosures are addressed in our Privacy Policy
• Google API Services:calendar data use complies with Google's Limited Use requirements
• SMS: transactional SMS includes opt-in, STOP opt-out, and disclosure requirements described in our Privacy Policy and Terms

Compliance roadmap

We are honest about what we have today versus what we are working toward. We do not display certifications we have not earned.

Responsible disclosure

If you believe you have found a security vulnerability in AI Sales Assistant, please report it responsibly. We welcome good-faith security research and will not pursue legal action against researchers who follow these guidelines:

• Report to us before public disclosure
• Do not access or modify other customers' data
• Do not perform denial-of-service or social engineering attacks
• Give us reasonable time to investigate and remediate

Security contact: ankur.tamhane@artillac.com
We aim to acknowledge reports within 72 hours.

Questions

General privacy questions: ankur.tamhane@artillac.com
Legal documents: Privacy Policy · Terms of Service