Security — Overview
Security is one of HaveAI's core design principles. Your customer data and your account are protected by multiple layers. This page gives an overview of the main security measures.
Account Security
- Two-factor authentication (2FA): Extra protection via an authenticator app (TOTP) or email code. See 2FA.
- Strong password policy: A strong password is required at sign-up.
- Session management: You can view and terminate your active sessions.
- Role-based access: Team members access only the areas they're authorized for. See Roles & Permissions.
Data Security
- Encryption: Sensitive credentials like bot tokens are stored encrypted; not kept in plain text.
- HTTPS enforced: All traffic is transmitted encrypted over HTTPS.
- Security headers: Content Security Policy (CSP) and other protective HTTP headers are applied.
- Rate limiting: Requests are throttled to prevent abuse and brute-force attacks.
AI Security
- PII (personal data) detection: Sensitive personal information in messages can be detected and masked.
- Content protection: Safety layers that prevent the assistant from producing inappropriate content.
- Spam protection: Detection mechanisms against unwanted/malicious messages.
A layered approach
No single measure is sufficient alone. HaveAI uses complementary protections at the network, application, data and AI layers.
Your part of security
Part of security is on you: use a strong password, enable 2FA, keep your API keys secret, and grant team members only the permissions they need.
Training content protection
Documents you upload and web pages you scrape are scanned for secrets before processing. Sensitive data such as API keys, passwords, or private keys is automatically masked — it is never stored in plain text or leaked in assistant replies.
Related Topics
Was this page helpful?