Security and Data Protection

Last updated: November 5, 2026

This page summarizes ChatDirect's security measures. How we handle personal information is described in detail in our Privacy Policy.

At a glance

Data stored in Canada: an OVH server in Beauharnois, Quebec, and a Supabase database on AWS in Montréal.
Encryption: HTTPS in transit, AES-256 at rest, passwords hashed with bcrypt.
Controlled access: two-factor authentication on every portal, data isolated per client, no access by our team without your permission.
SOC 2 and ISO 27001: ChatDirect has neither a SOC 2 report nor an ISO 27001 certificate. Our detailed answers are in the FAQ.

Where your data is stored

Your account data is stored in Canada:

Application and files: an OVH server located in Beauharnois, Quebec.
Database: Supabase (PostgreSQL) on Amazon Web Services, ca-central-1 region, in Montréal. It holds accounts, conversations, CRM contacts and the embeddings of indexed documents.

To produce chatbot replies, message content is sent to the selected AI provider (see Artificial intelligence).

Encryption

In transit: all traffic goes through TLS (HTTPS), with HSTS enabled.
At rest: the database is encrypted with AES-256.
Secrets: the API keys and integration credentials you save in your portal are encrypted with AES-256-CBC.
Passwords: hashed with bcrypt, never stored in plain text.

Access to data

Two-factor authentication (2FA): with a TOTP authenticator app and backup codes, available on every portal.
Isolation: each client's data is kept separate from every other client's data.
ChatDirect team access: no access to your data without your explicit, temporary permission, valid for 72 hours at most and granted only for technical support or incident resolution.

Application protection

Cross-site request forgery (CSRF) protection on forms.
Server-side request forgery (SSRF) protection on webhooks.
Rate limiting on sensitive endpoints.
Strict validation of incoming data.
HTTP security headers: HSTS, X-Frame-Options, X-Content-Type-Options.
Regular internal security audits.

Artificial intelligence: what is sent

To generate a reply, message content is sent to the AI provider behind the selected model: Anthropic, OpenAI or Google in the United States, or Mistral in Europe. The CRM's AI features follow the same rule (details in section 4 of the Privacy Policy).

When you index documents or web pages, their text is sent to OpenAI to compute embeddings, which are then saved in the database in Canada.

Under their API terms, these providers do not train their models on this data.

Payments

Payments are processed by Stripe, a PCI DSS Level 1 service provider. ChatDirect never sees or stores card numbers.

If an incident occurs

If a data breach is likely to put the rights and freedoms of the people concerned at risk, we commit to:

notifying the Commission d'accès à l'information du Québec, Quebec's privacy regulator, within 72 hours;
informing the people concerned as soon as possible;
documenting the incident and the corrective measures taken.

Sub-processors

The table shows each provider's role and where it processes the data it receives.

Provider	Role	Processing location
OVH	Application and file hosting	Canada (Beauharnois, Quebec)
Supabase (on AWS)	PostgreSQL database and embeddings (pgvector)	Canada (AWS ca-central-1, Montréal)
Anthropic	Chatbot replies and CRM AI features (Claude models)	United States
OpenAI	Chatbot replies and CRM AI features (GPT models), embeddings for indexed documents	United States
Google	Chatbot replies and CRM AI features (Gemini models)	United States
Mistral	Chatbot replies and CRM AI features (Mistral models)	Europe
Stripe	Payments	United States
SMTP2GO	Transactional email (primary provider)	New Zealand, United States
SendGrid, Brevo, Mailgun, Amazon SES	Notification email (backup providers)	Depends on the provider
Twilio	SMS and WhatsApp Business, if you set them up	United States
Meta	Messenger and Instagram, if you set them up	United States

Law 25 and GDPR

ChatDirect gives you settings to help you meet your obligations under Quebec's Law 25 and the European GDPR. Data retention, transfers outside Canada and individual rights are covered in our Privacy Policy.

Frequently asked questions

Do you have a SOC 2 report?

No, ChatDirect does not hold a SOC 2 report at this time. It isn't ruled out, but no date has been set.

Our main providers (AWS and Supabase, Stripe, Anthropic, OpenAI) each hold their own SOC 2 Type II report, which covers their services, not ChatDirect.

Does your company use a security questionnaire? Send it to us and we'll fill it out.

Do you hold an ISO 27001 certificate?

No, ChatDirect does not hold an ISO 27001 certificate at this time. It isn't ruled out, but no date has been set.

Does your company use a security questionnaire? Send it to us and we'll fill it out.

Where is my data stored?

In Canada: the application runs on an OVH server in Beauharnois, Quebec, and the Supabase database runs on AWS in the ca-central-1 region (Montréal).

To generate a reply, message content is sent to the AI provider behind the selected model: Anthropic, OpenAI or Google in the United States, or Mistral in Europe.

Do the AI providers train their models on our data?

Under their API terms, Anthropic, OpenAI, Google and Mistral do not train their models on data they receive through the API.

Contact us

A security question, or a questionnaire to fill out? Get in touch or email info@chatdirect.ca.

Security and data protection