Trust & Security

Built for the team that has to answer to a security review.

Q: Where is my data physically stored?

Default region is Dallas, Texas. Customers can choose or switch to Beauharnois, Quebec; London, United Kingdom; or Sydney, Australia from the server-location settings when agents are signed out and active chats are closed. Self-hosted deployments live wherever you put them.

Q: How do you handle visitor right-to-be-forgotten requests?

Two paths. As an admin, hit the Delete button on any visitor row in the dashboard — cascades through visitor + events + transcripts + segments. Or programmatically: DELETE /v1/api.ashx?resource=visitors&id=N with a write-scoped token. The deletion is immediate; backups retain the data for 30 days then it's gone.

Q: Are you SOC 2 certified?

Not yet. Our controls are aligned to SOC 2 principles (security, availability, confidentiality) and are documented — the control overview is available on request via the links above. Formal SOC 2 and ISO 27001 certification are on the security roadmap; we will state it here, plainly, when a report exists.

Q: Does the AI chatbot send my data to OpenAI?

On the managed AI plan: yes, the relevant chat snippets + KB chunks are sent to OpenAI to generate replies. We send the minimum needed and never train OpenAI's models on your data (their API ToS excludes this by default). On the bring-your-own-key plan, you own the OpenAI relationship directly. For zero-AI-data-egress, use self-hosted with a local model.

Q: What about HIPAA for healthcare workloads?

HIPAA-compliant deployment is available via the self-hosted option only — we'll sign a BAA. Our managed cloud is not HIPAA-attested. If you need PHI in chat conversations, contact sales for a self-hosted quote.

Q: How do I report a security vulnerability?

Email security@mylivechat.com. We respond within one business day, typically faster. Pilot bounty program rewards eligible findings; ask for the scope when you submit.

GDPR support, DPA terms, encryption everywhere, regional data residency, visitor deletion workflows, and a self-hosted option for the most compliance-bound deployments. The page your procurement team will ask for.

All systems operational · Service status is monitored continuously

Security and privacy commitments

SOC 2-aligned controls Certification on roadmap

GDPR Support DPA and privacy controls

CCPA Ready California privacy rights honored

ISO 27001 Aligned controls; cert in progress

HIPAA Available Self-hosted only

Security pillars

The four guarantees you can put in writing.

Not vague reassurances. Specific commitments backed by audited controls.

Encryption everywhere

All data encrypted in transit and at rest. No clear-text customer data ever leaves a TLS connection.

TLS 1.2+ required for every visitor / agent / API connection
AES-256 at rest for chat transcripts and visitor PII
SHA-256 hashed API tokens, OAuth secrets, webhook signing keys
HMAC-signed outbound webhook payloads (sha256 hex digest)
Database backups encrypted with rotating keys

Regional data residency

Pick the managed region nearest your audience, or use self-hosted deployment for stricter residency requirements.

US region — Dallas, Texas, default for new sites
Canada region — Beauharnois, Quebec
Europe/UK region — London, United Kingdom
Australia region — Sydney, Australia
Self-hosted — deploy in your own VPC for the most regulated workloads
Region can be changed from the dashboard after agents sign out and active chats close

Access controls

Least-privilege role assignments, audit logs of every admin action, optional SSO + MFA.

Role-based access — Owner / Admin / Agent / Viewer
SSO via SAML 2.0 on Growth plans (Okta, Azure AD, Google Workspace)
MFA enforcement via TOTP for every admin account
Team transparency log — who did what, when, immutable
Session expiry + IP allow-listing on Growth plans

Incident response

Documented runbooks, on-call rotation, public status page, customer notification SLAs.

24/7 on-call rotation for P0 / P1 incidents
Public status page with subscribe-by-email or RSS
Customer notification <24h for any data-impacting incident
Post-mortems for every P0/P1 published within 30 days
99.95% monthly uptime SLA on Growth plans (with credits)

Where your data lives

Pick a region, pin it for life.

Managed regions for latency and jurisdiction needs, plus self-hosting for custom residency requirements.

🇬🇧

United Kingdom / EMEA

All plans

Primary: London, United Kingdom. Best fit for UK and nearby European traffic. EEA transfer safeguards are addressed through the DPA where applicable.

🇨🇦

North America

All plans · default

Primary default: Dallas, Texas, US. Canada option: Beauharnois, Quebec. Pick the region nearest most of your visitors.

🏢

Self-hosted

Custom plans

Deploy MyLiveChat into your own VPC (AWS, Azure, on-prem). For HIPAA, FedRAMP, regional sovereign-cloud requirements. Talk to sales for a quote.

Visitor data lifecycle

Right-to-be-forgotten, by API.

Most platforms make data deletion a support ticket. We make it an HTTP DELETE.

From collection to deletion in three commitments.

Visitor PII is the highest-risk data we hold. We treat it accordingly.

1 · Collected

Only what your SDK explicitly identifies, plus session metadata. No fingerprinting. No third-party trackers. No background telemetry from the widget.

2 · Stored

AES-256 at rest, regional data hosting, role-based access, audit-logged on every admin read. Backups encrypted with rotating keys.

3 · Deleted

DELETE /v1/api.ashx?resource=visitors&id=N — cascades to events, transcripts, and segments. Honors GDPR / CCPA right-to-be-forgotten.

AI governance

The AI-specific answers procurement asks for now.

Security review is no longer just about encryption and uptime. Buyers also want to know how the bot is grounded, how it hands off, how spend is controlled, and how automations are verified.

Grounded answers, not freeform guesses

The chatbot answers from your knowledge base, cites which article it used, and keeps reviewable transcript history so admins can inspect accuracy instead of trusting a black box.

See AI controls →

Human handoff with reason codes

Low-confidence answers, explicit "talk to a human" requests, and frustration signals can trigger handoff while preserving the full transcript and handoff reason for the agent.

See handoff flow →

Spend and data-egress controls

Choose managed AI or bring your own OpenAI key, set per-site reply caps, and use self-hosted deployment when your policy requires the tightest control over where inference happens.

See pricing paths →

Signed automations and delivery logs

Outbound webhooks are HMAC-signed, retry-aware, and delivery-tracked so downstream ticketing, CRM, and alerting automations remain inspectable during security review.

Review developer docs →

Controlled rollout surfaces

Feature flags let teams stage voice, workflow, webhook, and portal changes gradually instead of exposing unfinished operational changes to every workspace at once.

See shipped operations work →

Migration and import audit trails

Ticket, macro, and knowledge-base imports are tracked as auditable runs so teams replacing another platform can prove what moved, when it moved, and whether anything failed.

See migration workflow →

Sub-processors

Every vendor we hand data to.

Full transparency. We notify on changes 30 days before they take effect.

Sub-processor	Purpose	Region
AWS	Primary application hosting + RDS managed databases	CA / EU / US
Stripe	Payment processing for plan subscriptions	US
PayPal	Alternate payment processing	US
OpenAI	AI chatbot inference (managed plan only; bypass with bring-your-own-key)	US
SendGrid	Transactional email (signups, password reset, transcript delivery)	US
Cloudflare	CDN + DDoS protection for the visitor-side widget	Global

Subscribe to sub-processor change notifications: trust@mylivechat.com

Documentation

Available on request.

Sales engineering will walk your security team through these — or send the documents under NDA.

Security controls overview

SOC 2-aligned control documentation covering security, availability, confidentiality. Shared under NDA.

Request access →

CAIQ-Lite questionnaire

Pre-completed Cloud Security Alliance assessment (~250 control questions).

Request access →

Data Processing Agreement

Public DPA covering processor terms, sub-processors, security measures, transfer safeguards, and deletion.

Review DPA →

Penetration test summary

Annual third-party pen-test executive summary (full report under NDA).

Request access →

Architecture overview

Network diagram, data flow, key management. For your security team's review.

Request access →

Vulnerability disclosure

Found something? Email security@mylivechat.com. Bounty program in pilot.

Email security team →

Common questions

Security FAQ.

Where is my data physically stored?

Default region is Dallas, Texas. Customers can choose or switch to Beauharnois, Quebec; London, United Kingdom; or Sydney, Australia from the server-location settings when agents are signed out and active chats are closed. Self-hosted deployments live wherever you put them.

How do you handle visitor right-to-be-forgotten requests?

Two paths. As an admin, hit the Delete button on any visitor row in the dashboard — cascades through visitor + events + transcripts + segments. Or programmatically: DELETE /v1/api.ashx?resource=visitors&id=N with a write-scoped token. The deletion is immediate; backups retain the data for 30 days then it's gone.

Are you SOC 2 certified?

Not yet. Our controls are aligned to SOC 2 principles (security, availability, confidentiality) and are documented — the control overview is available on request via the links above. Formal SOC 2 and ISO 27001 certification are on the security roadmap; we will state it here, plainly, when a report exists.

Does the AI chatbot send my data to OpenAI?

On the managed AI plan: yes, the relevant chat snippets + KB chunks are sent to OpenAI to generate replies. We send the minimum needed and never train OpenAI's models on your data (their API ToS excludes this by default). On the bring-your-own-key plan, you own the OpenAI relationship directly. For zero-AI-data-egress, use self-hosted with a local model.

What about HIPAA for healthcare workloads?

HIPAA-compliant deployment is available via the self-hosted option only — we'll sign a BAA. Our managed cloud is not HIPAA-attested. If you need PHI in chat conversations, contact sales for a self-hosted quote.

How do I report a security vulnerability?

Email security@mylivechat.com. We respond within one business day, typically faster. Pilot bounty program rewards eligible findings; ask for the scope when you submit.

All in one platform