Security

This page describes how Talven CX Studio is hosted and protected today. It states only what is in place now. The providers that process personal data for us are listed on our Subprocessors page.

Where it runs

• The application runs on Google Cloud, in Google Kubernetes Engine, in the us-central1 region (Iowa, United States). Its files and backups are stored in the same region.
• Its database is MongoDB Atlas, on Google Cloud in the central United States.
• The service that reads your website to build your assistant runs on Google Cloud in Zurich, Switzerland.

Network

• The application's servers have no public IP address, and the cluster's control plane has no public endpoint.
• The servers reach the internet through one fixed address. The database accepts connections only from that address, with a database user limited to this service's own databases.
• Inside the cluster, each part of the application accepts connections only from the parts that call it.
• Each public address answers only the routes it is for. The sign-up address, for example, serves sign-up, the payment provider's notifications and a health check, and nothing else.

Encryption and keys

• Every page and API of Talven CX Studio is served over HTTPS.
• Stored data is encrypted at rest by Google Cloud and by MongoDB Atlas, as each provider does by default.
• The keys and passwords our production service uses to reach other services are kept in Google Secret Manager.
• When we connect your assistant to one of your own systems, the credentials for that system are stored encrypted.

Your team's access

• Each person signs in to the console with their own account. Passwords are stored only as bcrypt hashes.
• Repeated failed sign-ins lock an account for a while. A sign-in lasts at most 30 days, and each person can see where they are signed in from My account.
• Each person has a role: Owner, Admin or Member. The role is checked on every request, and a Member sees only their own work.
• Sign-in with a second factor, and single sign-on, are not available yet.

Talven staff

Talven staff can open a workspace's console to support it. They do so from our internal admin, which admits only people we have added as staff.

Payments and sign-up

• Payments are handled by Stripe. Your card details go to Stripe; we never receive them.
• Sign-up is protected against bots by Cloudflare Turnstile, and the number of sign-ups from one network is limited.

Backups

The application's cluster is backed up every day, and each backup is kept for 7 days.

Keeping and deleting data

• The owners and admins of a workspace can find what it holds about one person, and export or erase it, from the console's Privacy requests page.
• A workspace whose assistant has been paused for a billing reason for 90 days is deleted, with its conversations, contacts, knowledge and assistant. We email the account owner 30 days and 7 days before. See our Terms of Service (§6.8) and Privacy Policy (section 6).

Certification

We do not hold a third-party security certification, such as SOC 2 or ISO/IEC 27001, today.

Report a security issue

If you think you have found a security issue in Talven CX Studio, email [email protected] with the subject "Security". A person reads every message. You can see whether the service is working on our Status page.