Skip to content
Security & compliance

Trust you can verify, not just take our word for

TruSend is built so the regulated parts of support — personal data, payments, audit history — are handled correctly by default, in the widget on your customers’ site and the workspace your team works in. Here’s what that means in practice, in plain language

Request security docsRead the Privacy Policy
Encrypted in transit & at restTenant isolationPII redactionAudit trailsSelf-service exportNo training on your data

Last reviewed · June 13, 2026

The data journey

Follow one message, end to end

The fastest way to trust a system is to watch where your data goes. Here’s every hop a customer conversation takes — and the control that guards each one

one customer message→ followed end to end
  1. 1

    It starts anonymous

    The widget opens an anonymous session behind a bot check — no visitor login, and the bootstrap calls omit credentials so cookies never ride along

  2. 2

    Encrypted in transit

    The conversation runs over a secure WebSocket and every bootstrap call over HTTPS — TLS on every hop, in and out

  3. 3

    PII stripped before the model

    Switch it on and emails, phone numbers, card numbers and IPs are redacted out of the content before it ever reaches an AI provider

  4. 4

    Scoped to your workspace

    Stored encrypted at rest and read back only inside your organization — cross-tenant access is impossible by construction, not by policy

  5. 5

    Answered, never memorized

    AI providers act as subprocessors under a data-processing agreement — your customers' conversations never train models shared with anyone else

  6. 6

    Written to the audit trail

    Sensitive actions land in append-style logs with who, when and before/after — each kept for a retention window tuned to the record

Two surfaces, one standard

The SDK on your site and the desk your team works in

TruSend has two front doors — the widget your customers talk to and the workspace your agents run. Each is locked down for what it actually does

Nerv

The widget on your site

The script you paste carries public identifiers only — never a secret

  • No signing key in your page: the bundle ships public IDs, and the build forces the JWT secret empty so it can't slip back in
  • Locked to your domains: with the allowlist on, any other origin fails the verify check and the widget never loads your config or opens a socket
  • Messages sanitized both ways: markdown through rehype-sanitize, help content through a strict DOMPurify allowlist — javascript:, data: and file: links blocked
  • Renders in the light DOM, no iframe — restylable from the panel, with a CSS check worth budgeting on first install
  • Crash reports scrubbed in the visitor's own browser — passwords, tokens, cookies and anything that looks like an email are stripped before a report reaches us
  • Signed identity when you want it: hand the widget a backend-signed token to attach a chat to a known customer

Portal

Where your team works

Least-privilege by default, and every change on the record

  • Isolated by tenant: every query is scoped to your organization, so another workspace can't read yours by construction
  • Role-scoped access with workspace defaults the server enforces — lock a field and overrides are rejected, not just hidden
  • An audit log that remembers: settings, AI and account events with who, when and before/after values, kept 90 days
  • API keys displayed masked, with two live keys per workspace so you rotate a leaked one with zero downtime
  • PII redaction before the model, per workspace — the same strip of emails, phones, cards and IPs your customers get
  • Encrypted at rest, and drafts sealed in the browser with a short-lived AES-256-GCM key
Standards we’re aligned with

Mapped to the regulations that matter

We describe these as standards our controls are aligned with — concrete features that meet their requirements — rather than certificates we ask you to assume

GDPRAligned

EU General Data Protection Regulation

We’re the processor for the conversations moving through your workspace and the controller for your account data — and the rights that come with that distinction are wired into the product, not handled by ticket

  • Self-service data export: any user can download their personal data as a portable archive
  • Right to erasure with a verified two-step email confirmation — accounts are deleted and personal fields anonymized
  • Records-of-processing audit retention aligned with GDPR Article 30 obligations, then purged on schedule
  • PII redaction can strip emails, phone numbers, card numbers and IPs before content reaches an AI model
  • A Data Processing Agreement and the current subprocessor list are available on request
Read the Privacy Policy
PCI-DSSAligned

Payment Card Industry Data Security Standard

Card data never touches TruSend’s servers. Payments are handled by a Level 1 provider, and the controls around payment-adjacent activity follow PCI-DSS guidance

  • Payments run through Paddle, a PCI-DSS Level 1 merchant of record — we never see or store full card numbers
  • Audit trails for sensitive actions follow PCI-DSS Requirement 10, with defined retention windows
  • A defense-in-depth detector blocks card numbers, IBANs and national-ID patterns from being sent in chat
  • API keys are displayed masked and can be rotated or revoked at any time
Read the Terms
Security by default

The controls under the hood

None of this is a paid add-on or an enterprise upsell. It’s how every workspace runs

Encrypted in transit and at rest

Traffic is protected with TLS, stored data is encrypted at rest, and message drafts are sealed in the browser with a short-lived, ephemeral AES-256-GCM key

Isolated by tenant

Every query is scoped to your organization. Cross-workspace reads are impossible by construction — not just discouraged by policy

PII redaction before the model

Switch it on per workspace to strip emails, phone numbers, card numbers and IP addresses from content before it ever reaches an AI provider

Sensitive data, blocked on send

A detector flags credit-card, IBAN and national-ID patterns and can stop them leaving the composer — recording an audit event, never the raw value

Audit trails on every change

Configuration, AI and account events are written to append-style logs, each with a retention window tuned to what the record is for

Your data stays yours

Export tickets, contacts and transcripts whenever you want. Delete a workspace and it’s purged from production within 30 days. We never train shared models on your conversations

Straight answers

What we will and won’t claim

Overstating compliance is a fast way to lose a security team’s trust. So here’s the line we hold

We will
  • Describe controls the product actually ships — and walk your security team through them
  • Map our features to GDPR and PCI-DSS requirements, in plain language
  • Send a DPA and our current subprocessor list on request
We won’t
  • Badge a SOC 2 or ISO 27001 certificate we don't hold
  • Invent a data center, region or metric to win a checkbox
  • Train shared AI models on your customers' conversations
Questions security teams ask

Straight answers

What we hold, what we don’t, and how to get the documents your review needs.

We won’t claim a certificate we don’t hold. The controls those audits test for — encryption, least-privilege access, tenant isolation and change auditing — are already built into the platform, and we’re happy to walk a security team through them. If a formal report is a hard requirement for you, tell us and we’ll share exactly where we are.

Bring this to your security review

Need a DPA, the subprocessor list, or a walkthrough of our controls? Send one email and we’ll get you what your review needs

Email privacy@trusend.aiRead the Terms

Found a vulnerability? Report it to privacy@trusend.ai — we read every report and respond.