Your customers trust you. Here’s how we keep it that way.
The measures that exist in IsTyping today, described plainly — nothing more.
IsTyping holds no security certifications (such as SOC 2 or ISO 27001). Everything on this page is a property of the product you can check, not a badge.
Security measures
Accounts and sign-in
- Passwords stored as scrypt hashes, never readable.
- Two-factor sign-in (TOTP) with ten single-use recovery codes; lock-out with back-off after five wrong codes.
- Sensitive actions — API tokens, secrets, changing your email or password — ask you to confirm it’s you again.
- Single sign-on with Google or any OpenID Connect provider (authorization code flow with PKCE). Owners can require two-factor or their own SSO for their team.
Sessions and the web app
- The session cookie is HttpOnly, SameSite=Lax and Secure on HTTPS; changes must come from the app’s own origin.
- A strict Content-Security-Policy; the app refuses to be framed and turns off content sniffing.
- Sign-in, sign-up and the chat widget’s endpoints are rate-limited per IP address.
Separation between customers
- Every workspace’s data is queried with its own id; another workspace’s resource answers “not found”.
- Roles (owner, admin, agent) decide who may change settings, the team and integrations.
- Automated tests check the isolation on the API and the realtime connections.
Secrets and credentials
- Stored integration credentials — WHMCS, mail servers, messaging providers, AI keys — are encrypted with AES-256-GCM and can only be replaced, never read back.
- API tokens are stored as hashes and shown once; they cannot reach secrets, team management or deleting a workspace.
- Outgoing webhooks are signed (HMAC-SHA256 with a timestamp).
The chat widget
- Visitor text is always displayed as text, never as HTML.
- Uploads are limited to 10 MB, stored under random names and served as downloads unless they are a safe image type.
- Identity can be proven with a signature from your server; integrations such as WHMCS only show private data for verified visitors.
- Internal notes and timeline events are never sent to visitors.
Co-browsing
- Viewing asks the visitor first by default, and a “Stop sharing” bar shows for the whole session.
- Password fields are always masked; all inputs can be masked. The widget itself is never recorded.
- Remote control is off by default, always asks, ends on the visitor’s first key or click, and never reaches passwords, payment fields or file uploads. Typed text is never stored.
Tools for the requests you will get.
You decide what happens to your customers’ data; IsTyping gives you the tools to do it.
- Access: export everything about one person as a ZIP with a readable summary.
- Erasure: delete or anonymise, finished with a signed certificate and a suppression record so imports can’t bring the person back.
- Retention: how long each kind of data is kept; legal holds keep what you must.
- Notice or consent in the widget, and visitor location without storing the IP address.
- An audit log of security- and privacy-relevant actions.
Sign-in that holds up.
Two-factor for everyone who wants it, required for everyone if the owner says so — and single sign-on for teams that live in one identity provider.
Where your data lives.
The service runs on Nexuscore, LLC (its own network and servers) in United States. Conversations, contacts and files are stored there.
Other companies only receive data when you turn on a feature that needs them: an AI provider when you enable AI assist, Twilio when you connect SMS or WhatsApp, Telegram when you connect a bot, a GIF service when GIFs are on, Stripe when you pay by card. The full list, with what each one receives, is in the Data Processing Addendum.
There is no advertising or analytics tracking in IsTyping — not in the app, not in the chat widget, and not on this website, which loads nothing from other servers. The cookie notice lists exactly what is stored in the browser.
Reporting a vulnerability
Please email security@istyping.ai with the details and steps to reproduce. We will acknowledge your report and keep you informed while we fix it. Please do not access other customers’ data or degrade the service while testing.
Questions about security?
We’re happy to go through how a specific feature handles data before you roll it out.