Security form, answered
These are the questions purchasing and security teams ask before they approve a vendor. They are answered here so no one waits two weeks for an email.
When the answer is "we do not have it", that is the real answer. Vendor reviews check facts, and a false claim costs more than the gap it tried to hide.
Summary in 7 facts
- These are the questions purchasing and security teams ask before they approve a vendor.
- They are answered here so no one waits two weeks for an email.
- When the answer is "we do not have it", that is the real answer.
- Vendor reviews check facts, and a false claim costs more than the gap it tried to hide.
- How do our team members join the platform?: With email and password, or with Google.
- Everyone gets their own login; the account is not shared.
- The database is in the United States (Google), and WhatsApp replies are written in the United States (DeepInfra, which runs the DeepSeek model).
In numbers
| Number | What it means |
|---|---|
| 7 days | The database has one backup per day, kept for 7 days, so anything deleted is gone from the backups within 7 days. |
| 365 days | The log is kept for 365 days and exports as CSV. |
Access and identity
- How do our team members join the platform?
- With email and password, or with Google. Everyone gets their own login; the account is not shared.
- Is there corporate single sign-on (SAML SSO)?
- No. CertuAI does not offer SAML or automatic user provisioning via SCIM yet. Joining and leaving the team is done manually in the Dashboard by the account owner.
- Is there two-factor authentication?
- When you sign in with Google, your Google two-factor settings apply. CertuAI does not offer its own two-factor authentication for password login.
- Can you separate what each person sees and does?
- Yes, with five fixed roles: owner, admin, edit, read-only and salesperson. Read-only members cannot change anything. A salesperson only sees the contacts, deals and tasks assigned to them. An admin can do what the owner does, except pay, cancel the plan and delete the account or the knowledge base. The restriction is enforced on the server, not just on the screen. There are no custom roles and no permissions by team, by business unit or by field.
- Does the CertuAI team access our account?
- Yes, for support and operations. When someone at CertuAI opens an account’s knowledge base, conversations, calls, site or WhatsApp connections, or changes its site, connection, plan or subscription, a line is added to the log the owner sees in the dashboard. Coverage is not complete: internal screens that list every account at once do not leave a line in each account.
- How do we revoke access for someone who left?
- The owner removes the person in Dashboard and access ends right away. The log of actions they took stays saved.
Data
- Is the data kept in Brazil?
- Not all of it. The database is in the United States (Google), and WhatsApp replies are written in the United States (DeepInfra, which runs the DeepSeek model). The QR code connection server (Hostinger) and billing (Asaas) are in Brazil. The full list is right below.
- Is the data encrypted?
- In transit, yes: all traffic is HTTPS. At rest, standard Google Cloud and Cloudflare encryption applies. CertuAI does not add a second custom layer per field, and does not manage its own keys.
- Do you use our conversations to train models?
- No. CertuAI does not train AI models on the conversations. They only power the account's own customer service.
- How long is data kept?
- For as long as the account exists. The owner deletes the account on their own, on the account deletion page, without asking anyone, and deletion can also be requested at [email protected]. The database has one backup per day, kept for 7 days, so anything deleted is gone from the backups within 7 days. Billing and invoice records are kept for the legal period, without the payer's name and tax ID.
- Can we take our data with us?
- Yes. From the Max plan onwards, authenticated HTTP export in NDJSON is available for your data team to pull on schedule. It works with Snowflake, BigQuery, or custom scripts.
- Is our data kept separate from other customers’ data?
- By account, inside the same database and the same application. Every access is checked on the server against the identity of the signed-in person. There is no dedicated database or environment per customer.
Companies that receive the data
The same list as on the security and privacy pages.
| Company | What it does | What data it receives | Where it is |
|---|---|---|---|
| Google Cloud and Firebase | Database, account login and the daily backup of the database. | Everything the account stores: sign-up details, conversations, contacts, Brain and CRM. | United States |
| Cloudflare | Delivers the website and the dashboard, runs the server routes, protects against abuse and stores the files (audio, photos, documents and call recordings). | All website and dashboard traffic, and the files from conversations. | Not disclosed by the provider |
| DeepInfra | Runs the DeepSeek model, which writes the WhatsApp agent's replies and reads the business's conversations to build the Brain, and the models that create the studio's images and videos. | The conversation text and the business's Brain, at the moment of each reply, whatever the owner sends to the studio, and what a visitor types in the home page chat to build the agent, even without an account. | United States |
| Google Gemini | Replies in place of DeepSeek when it fails (and is the main model on some accounts), transcribes voice messages and reads PDFs that have no text. | The conversation text, the business's Brain, and incoming voice messages and PDFs. | United States |
| OpenAI | Reads photos that arrive on WhatsApp, transcribes calls, and transcribes voice messages when Gemini fails. | Photos, voice messages and call audio. | United States |
| Anthropic | Reads the photos and PDFs attached in the home page conversation and PDFs with no text when Gemini fails, and runs dashboard features such as organizing the Brain. | The photos and PDFs attached in the conversation, the Brain and the conversations those features use. CertuAI does not keep the file attached in the conversation. | United States |
| Meta | Carries messages to and from WhatsApp when it is connected through the official API, and also Instagram and Messenger messages. | The messages and phone number of whoever talks to the business. | United States |
| Hostinger (Evolution server) | Keeps the WhatsApp connection running when the number is connected by QR code instead of the official API. | The messages and phone number of whoever talks to the business. | Brazil |
| Twilio | The phone line and the call itself, for the voice agent and the dialer. | The caller's number and the call audio. | United States |
| ElevenLabs | The voice of the phone agent. | The call audio and text. | United States |
| Asaas | Billing in Brazil: card, bank slip and Pix. | The payer's name, tax ID, email, phone and address. | Brazil |
| Stripe | Billing outside Brazil. | The payer's name, email and payment details. | United States and Ireland |
| Resend | Sends the platform's emails. | The recipient's email address and the email text. | United States |
| Systems the company connects itself | When the company connects its own account, CertuAI sends it what the integration needs: CRM (such as Salesforce, HubSpot and Pipedrive), calendar (Google Calendar), ads (Google Ads), clinic software (such as Feegow) and others. | Name, phone, booked time and the conversation summary, depending on the integration. | Depends on the system the company chose |
| Google Analytics, Google Ads and Meta Pixel | Measure CertuAI's website and ads, only if the visitor accepts cookies. | How the visitor uses the website and, for people who sign up with CertuAI from an ad, their hashed email and phone. Never the end customers' conversations. | United States |
| Microsoft Clarity | Records how the website is used, only if the visitor accepts measurement cookies. | Clicks and scrolling of website visitors. | United States |
| Cloudinary | Stores the promotional images on CertuAI's website. | No conversation or account data; only the IP address of whoever opens a page with an image. | United States |
Auditing and content control
- Can we see who changed what the bot answers?
- Yes. Every change to the knowledge base logs who made it, when, the old value, and the new one. Each log has a digital signature so you can check later if it was changed.
- Is this record immutable?
- Not in the strict sense. The signature proves that a record’s content was not edited, but the storage does not stop a whole record from being deleted by someone with administrative access to the infrastructure. The log sits in the same database as the account’s data, not in separate storage. Keeping it in a way nobody can delete is a service CertuAI has not bought yet.
- Can we see who opened each conversation?
- Yes. The dashboard records who opened it, with which role, which contact’s conversation (with the phone number masked), from where and when. The log is kept for 365 days and exports as CSV. The conversation text is not stored in it. Only the account owner and admin see the list.
- Can I require approval before a reply goes live?
- Yes, with setup. When turned on, changes go to a review queue and only go live after someone else publishes them. The person who suggested the change cannot approve it.
- How do we know the bot is not making up answers?
- There is a monthly report that samples answers and checks each against the account knowledge base, sorting them into backed, baseless, or contradictory. It is an automated screening: it cuts down what needs human review, but does not replace it.
- Can I keep conversation logs for compliance?
- Yes, if you set it up. Each record gets a digital signature, the team has to agree, and searches use the words the company chooses. Today the record identifies the account, not the individual employee who replied.
Certifications and stance
- Do you have ISO 27001 or SOC 2?
- No. CertuAI has no security certification issued by an outside company. The servers CertuAI uses (Google, Cloudflare) have their own certifications, and those do not carry over to CertuAI.
- Do you run periodic penetration tests?
- No penetration test by an outside firm has been done to date.
- Is there a formal incident response plan?
- There is no formal incident response document with agreed deadlines. Incident notices are sent by email to account owners.
- What is the uptime commitment?
- There is no service level agreement with uptime percentage or penalties in the standard offer. Contract uptime commitments are handled case by case.
- Who controls the data and who processes it?
- The client business owns its customers' data. CertuAI processes this data only to provide the service. See details at /seguranca.
- Do you sign a data processing agreement?
- Yes, subject to review. The document is handled during the negotiation at [email protected].
Missing a question?
Send the spreadsheet to [email protected]. Full details on data, vendors, and storage are on the page for security and data handling.