Security and data handling

What data CertuAI handles

CertuAI handles the content of conversations your business receives and sends through connected channels, contact details of people who write in, documents and information you add for the agent to answer, your account signup details, and usage and billing logs. CertuAI does not ask for or store your card number: our payment processor handles that.

Roles under data protection law

Your customer conversations belong to you. CertuAI only looks after them for you and only uses the data for what you tell it to do. In legal terms: your business is the controller and CertuAI is the processor. Your account signup and billing details belong to CertuAI. To ask anything about personal data, email [email protected].

Where data lives

Data stays on Google servers. It travels encrypted and stays stored encrypted, so anyone who intercepts it cannot read it. Only the CertuAI team can log in, using Google accounts.

Companies that handle your data

Some of these companies operate outside Brazil, which is why data leaves the country. Whenever a new system starts touching client data, CertuAI updates this list.

Retention and deletion

Conversations and records remain available as long as the account exists, because customer service history and reports are built from them. Deletion of the account and associated data can be requested at any time on the account deletion page, and also in writing to [email protected]. Records required for tax and accounting compliance are kept for the period required by law.

Use of conversation content

Your business content is used to run your customer service and to build the Brain for your own Agent. CertuAI never sells this content and never uses it to build another customer's Agent. The text needed to write each reply is sent to the language model provider listed above at the moment of the reply.

What CertuAI does not have yet

CertuAI does not hold ISO 27001 certification or a SOC 2 report. The certifications mentioned in procurement processes belong to the hosting providers that CertuAI uses, like Google Cloud and Cloudflare, not CertuAI itself. CertuAI also does not currently run a formal recurring penetration test program with third-party reports.

This information is here because it is verifiable and will be verified. If your vendor approval process requires any of these items, tell us during our conversation and CertuAI will answer what is possible and in what timeframe.

Related documents

Privacy Policy e Terms of Service. The completed security questionnaire includes the standard vendor questions, already answered. Data processing agreements and custom contract terms can be reviewed during sales talks at [email protected].