No certifications yet. ChatRhino has not completed a SOC 2 or ISO 27001 audit. We describe the controls we have built so you can assess them yourself. Ask us for our security questionnaire answers at support@chatrhino.ai.
Identity
Sign-in and access
Single sign-on
SAML (signed assertions, replay protection) and OIDC (Authorization Code + PKCE). Email domains are DNS-verified; SSO can be enforced per tenant.
MFA and passkeys
TOTP authenticator apps, WebAuthn passkeys and single-use recovery codes. Tenant policy: off, admins only, or everyone.
Step-up for sensitive actions
Money movement, SSO and policy changes, API keys and factor removal need a recent second factor.
Sessions
Server-side sessions in httpOnly cookies, rotated every 15 minutes, with reuse detection, idle and absolute timeouts.
Password protection
argon2id hashing, per-IP and per-account rate limits, progressive lockout and identical responses to prevent account enumeration.
Roles and permissions
System roles plus custom roles per workspace. You can only grant access you hold. Last-owner protection.
Data
Isolation and encryption
Tenant isolation
Every query runs with the tenant set in the database transaction; PostgreSQL row-level security enforces the boundary, and the API connects as a non-owner role.
Envelope encryption
Provider and integration credentials are encrypted with AES-256-GCM per value, bound to tenant and purpose; key wrapping supports AWS KMS.
At rest and in transit
Encrypted database storage and KMS-encrypted media storage on AWS; TLS in transit with HSTS.
Audit log
Append-only and hash-chained per tenant. The app cannot edit or delete rows; the chain can be verified on demand.
Consent records
Opt-in and opt-out are recorded with time and source; suppression lists use keyed hashes.
Hardened API
Default-deny authorisation, CSRF protection, strict CSP, request size limits, and logs that redact credentials and personal data.
Where data goes
Regional data residency and sub-processors
Regional data residency (hosted in AWS Mumbai today). Production data — conversations, contacts, configuration and billing records — is stored on Amazon Web Services in the Mumbai region (ap-south-1). We do not offer other hosting regions yet; if you need one, tell us. As of November 2026
Some features necessarily send data to third parties:
| Category | Who | What and why |
|---|---|---|
| Hosting | Amazon Web Services (Mumbai) | All stored data; email sending (SES) |
| Meta; 360dialog where used as BSP | Messages you send and receive on WhatsApp | |
| Instagram / Messenger | Meta | Messages on those channels |
| Telegram, SMS | Telegram; Twilio or another SMS provider you choose | Messages on those channels |
| AI features | Anthropic (language model); an embeddings provider | Text needed to answer, summarise or draft. These providers may process data outside the hosting region. |
| Integrations | Tools you connect | Only what each integration needs |
We will publish a maintained sub-processor list with notice of changes before general availability.
On the roadmap
- SCIM user provisioning and deprovisioning
- Breached-password screening
- IP allowlists and device trust
- Exporting the audit chain head to write-once storage
- Independent security assessment and penetration test
Reporting a vulnerability
Email support@chatrhino.ai with “Security” in the subject. See also security.txt. Please do not test against other customers' data.