This article summarises the security controls that protect your account. Everything here describes the platform as it runs today; what HueChat does not yet claim is listed at the end.
- Every public connection uses TLS. HSTS is enabled with preload, and each page carries a per-request Content Security Policy.
- Channel credentials and OAuth tokens for WhatsApp, Instagram, Messenger, Telegram, LINE, Twilio and ad platforms are encrypted with AES-256-GCM before storage.
- Two-factor secrets are encrypted at rest. Passwords are hashed with bcrypt (cost 12) plus a server-side pepper.
- API keys are stored only as SHA-256 hashes; the full key is shown once.
- Managed databases and object storage use DigitalOcean's provider-managed encryption at rest.
- Vector-store backups are encrypted to an off-host recipient.
- Password sign-ins require a second factor: an authenticator app (TOTP) or a one-time code by email. A trusted device can skip repeat challenges.
- Ten single-use recovery codes are issued when you set up an authenticator.
- Sign in with Google is available. SAML single sign-on is not.
- Sessions time out after 30 days idle and 180 days in total, with at most five active sessions per user. You can list and revoke sessions from your profile, and changing your password signs out every session.
Screenshot: The Active sessions list in profile settings with the revoke option.
Every account-scoped request is authorised against the signed-in user's account. Row-level security policies in PostgreSQL, keyed on the account, reinforce that boundary for conversation, message, contact, inbox and billing tables, and the runtime database role has the least privilege it needs.
¶ Inbound webhooks and abuse controls
Webhooks from Meta, Twilio, Telegram and other providers are verified with each provider's signature or secret before they are processed. Requests are rate limited per IP and per API key, and request bodies are capped at 20 MB.
¶ Backups and recovery
- Managed PostgreSQL backups with a seven-day point-in-time recovery window.
- A restore drill every quarter against a temporary copy, never over production.
- Weekly encrypted, checksummed backups of the AI vector store, restore-tested on an isolated node.
- Immutable, pinned container images with a recorded rollback path.
- An hourly host security watch (SSH brute force, root logins, configuration and secret drift, service state, error volume) and a 30-minute database and vector perimeter watch, alerting the operations channel.
- A health endpoint checked from four regions and a public status page at status.huechat.ai.
- Application error reporting through Sentry, with query strings stripped from logs so tokens are never recorded.
CI blocks releases on vulnerability scanning, static analysis, race-enabled tests and high-severity dependency findings, and scans for leaked secrets. Dependencies are updated weekly. Production deploys are manual and human-approved, one host at a time.
HueChat does not currently hold a SOC 2 report or ISO 27001 certification, has not yet commissioned an independent penetration test, and does not offer end-to-end encryption or SAML SSO. The Trust Center at trust.huechat.ai is updated when that changes.