Security at Heyozo

Heyozo talks to your customers for you, so it holds conversations, orders and bookings. This page says plainly how that data is protected. For what we collect and why, see the Privacy Policy and Data Processing terms.

Your data is kept apart

• Every business's data is protected by row-level security in the database, enforced on every table that holds client data. A request for one business cannot read another's rows, even if the application asked by mistake.
• Automated tests check every dashboard screen and API route against a second business's data before each release.

Secrets and passwords

• WhatsApp access tokens, Telegram bot tokens and the keys of connected systems (such as Odoo or Zoho) are encrypted before they are stored, and are never shown again after you enter them.
• Passwords are stored only as salted hashes (scrypt). HMH Labz staff sign in to the operations console with a password and an authenticator code.
• Each person on your team has a role (admin, agent or viewer), and changes to settings are written to an audit log.
• Logs leave out message text and secrets; sensitive fields are removed before anything is written.

Backups

• The database is backed up every night and before every update.
• Each backup is encrypted to a key that is not kept on the server, so a stolen server or storage bucket cannot read it. Backups are kept off-site for 30 days.
• Restores are tested: a restored copy is compared with the original, table by table, row count by row count.

Official platforms, your own accounts

• Heyozo uses the official WhatsApp Business Platform. Your number and your WhatsApp Business account stay yours, and Meta bills its message charges to that account.
• On Telegram it answers through your own bot, using Telegram's Bot API.
• Marketing messages go only to customers who opted in, and an opt-out is honoured at once. Sending pauses on its own if your number's quality rating drops.

The AI assistant

• Replies are written by AI models from the providers listed on the Data Processing page, which receive only the conversation text needed for each reply. We do not use your customers' conversations to train AI models.
• Prices, stock and times come from your own catalog and calendar, never from the model's guesswork.
• The assistant says it is an AI assistant, and the topics you choose always go to a person.

Hosting and this website

• The application and database run on Amazon Web Services in the United States, behind HTTPS only.
• heyozo.com sets no cookies and runs no analytics, advertising or third-party scripts.

Reporting a security issue

Email hello@heyozo.com with "Security" in the subject. We reply within two working days and keep you updated until it is fixed.