Security

Security and data handling

This page gathers, in plain text, what legal and information security teams usually ask before approving a vendor. It describes our current state, including what does not exist yet.

About CertuAI: CertuAI is the AI that answers a small business's WhatsApp, Instagram and Messenger 24/7, with a built-in CRM, and is a Tech Provider on Meta's WhatsApp Business Platform. Paid plans start at US$ 99 a month, with no lock-in. Create my agent

Summary in 7 facts

This page gathers, in plain text, what legal and information security teams usually ask before approving a vendor.
It describes our current state, including what does not exist yet.
About CertuAI: CertuAI is the AI that answers a small business's WhatsApp, Instagram and Messenger 24/7, with a built-in CRM, and is a Tech Provider on Meta's WhatsApp Business Platform.
Paid plans start at US$ 99 a month, with no lock-in.
CertuAI does not ask for or store your card number: our payment processor handles that.
CertuAI only looks after them for you and only uses the data for what you tell it to do.
The database is at Google, in the United States.

In numbers

Number	What it means
US$ 99 a month	Paid plans start at US$ 99 a month, with no lock-in.
7 days	The database has one backup per day, kept for 7 days, so anything deleted is gone from the backups within 7 days.

What data CertuAI handles

CertuAI handles the content of conversations your business receives and sends through connected channels, contact details of people who write in, documents and information you add for the agent to answer, your account signup details, and usage and billing logs. CertuAI does not ask for or store your card number: our payment processor handles that.

Roles under data protection law

Your customer conversations belong to you. CertuAI only looks after them for you and only uses the data for what you tell it to do. In legal terms: your business is the controller and CertuAI is the processor. Your account signup and billing details belong to CertuAI. To ask anything about personal data, email [email protected].

Where data lives

The database is at Google, in the United States. Files (audio, photos, documents and call recordings) are stored at Cloudflare. When WhatsApp is connected by QR code, messages pass through a CertuAI server at Hostinger, in Brazil. Data travels encrypted and is stored encrypted, so anyone who intercepts it can't read it. Only the CertuAI team has access, and they sign in with a Google account.

Companies that handle your data

Company	What it does	What data it receives	Where it is
Google Cloud and Firebase	Database, account login and the daily backup of the database.	Everything the account stores: sign-up details, conversations, contacts, Brain and CRM.	United States
Cloudflare	Delivers the website and the dashboard, runs the server routes, protects against abuse and stores the files (audio, photos, documents and call recordings).	All website and dashboard traffic, and the files from conversations.	Not disclosed by the provider
DeepInfra	Runs the DeepSeek model, which writes the WhatsApp agent's replies and reads the business's conversations to build the Brain, and the models that create the studio's images and videos.	The conversation text and the business's Brain, at the moment of each reply, whatever the owner sends to the studio, and what a visitor types in the home page chat to build the agent, even without an account.	United States
Google Gemini	Replies in place of DeepSeek when it fails (and is the main model on some accounts), transcribes voice messages and reads PDFs that have no text.	The conversation text, the business's Brain, and incoming voice messages and PDFs.	United States
OpenAI	Reads photos that arrive on WhatsApp, transcribes calls, and transcribes voice messages when Gemini fails.	Photos, voice messages and call audio.	United States
Anthropic	Reads the photos and PDFs attached in the home page conversation and PDFs with no text when Gemini fails, and runs dashboard features such as organizing the Brain.	The photos and PDFs attached in the conversation, the Brain and the conversations those features use. CertuAI does not keep the file attached in the conversation.	United States
Meta	Carries messages to and from WhatsApp when it is connected through the official API, and also Instagram and Messenger messages.	The messages and phone number of whoever talks to the business.	United States
Hostinger (Evolution server)	Keeps the WhatsApp connection running when the number is connected by QR code instead of the official API.	The messages and phone number of whoever talks to the business.	Brazil
Twilio	The phone line and the call itself, for the voice agent and the dialer.	The caller's number and the call audio.	United States
ElevenLabs	The voice of the phone agent.	The call audio and text.	United States
Asaas	Billing in Brazil: card, bank slip and Pix.	The payer's name, tax ID, email, phone and address.	Brazil
Stripe	Billing outside Brazil.	The payer's name, email and payment details.	United States and Ireland
Resend	Sends the platform's emails.	The recipient's email address and the email text.	United States
Systems the company connects itself	When the company connects its own account, CertuAI sends it what the integration needs: CRM (such as Salesforce, HubSpot and Pipedrive), calendar (Google Calendar), ads (Google Ads), clinic software (such as Feegow) and others.	Name, phone, booked time and the conversation summary, depending on the integration.	Depends on the system the company chose
Google Analytics, Google Ads and Meta Pixel	Measure CertuAI's website and ads, only if the visitor accepts cookies.	How the visitor uses the website and, for people who sign up with CertuAI from an ad, their hashed email and phone. Never the end customers' conversations.	United States
Microsoft Clarity	Records how the website is used, only if the visitor accepts measurement cookies.	Clicks and scrolling of website visitors.	United States
Cloudinary	Stores the promotional images on CertuAI's website.	No conversation or account data; only the IP address of whoever opens a page with an image.	United States

Some of these companies operate outside Brazil, which is why data leaves the country. Whenever a new system starts touching client data, CertuAI updates this list.

Retention and deletion

Conversations and records remain available as long as the account exists, because customer service history and reports are built from them. Deletion of the account and associated data can be requested at any time on the account deletion page, which the owner uses without asking anyone, and also in writing to [email protected]. The database has one backup per day, kept for 7 days, so anything deleted is gone from the backups within 7 days. Records required for tax and accounting obligations are kept for the period the law requires.

Use of conversation content

Your business content is used to run your customer service and to build your own agent's knowledge base. CertuAI does not sell this content, does not use it to build another customer's agent, and does not use it to train AI models. The text needed to write each reply goes, at the moment of the reply, to DeepInfra, which runs the DeepSeek model. If it fails, it goes to Google Gemini. Audio, photos and PDFs go through the providers in the table above.

What CertuAI does not have yet

CertuAI does not hold ISO 27001 certification or a SOC 2 report. The certifications mentioned in procurement processes belong to the hosting providers that CertuAI uses, like Google Cloud and Cloudflare, not CertuAI itself. CertuAI also does not currently run a formal recurring penetration test program with third-party reports.

This information is here because it is verifiable and will be verified. If your vendor approval process requires any of these items, tell us during our conversation and CertuAI will answer what is possible and in what timeframe.

Privacy Policy and the Terms of Service. The completed security questionnaire includes the standard vendor questions, already answered. Data processing agreements and custom contract terms can be reviewed during sales talks at [email protected].

Talk to CertuAI

If your company is evaluating CertuAI as a vendor, the enterprise page brings together the scope and the contact form.

CertuAI for business

In short

This page says what data CertuAI stores, where it is kept, which companies handle it, how to delete everything, and which security certifications CertuAI has and does not have.