Your customers' trust — protected at every layer.
AI & Humn is built with security as a first-class concern, not an afterthought. Here's how we protect the data you and your visitors trust us with.
Nine pillars of our security posture.
All traffic between visitors, our API, the SPA, and the embedded widget is HTTPS-only. TLS certificates are auto-issued and auto-renewed by AutoSSL on our hosting platform. Insecure HTTP requests are 301-redirected at the edge — no plaintext path exists.
Customer passwords are never stored in plaintext. We use Argon2id with conservative memory + time costs — the modern winner of the Password Hashing Competition and the recommended choice over bcrypt / scrypt / PBKDF2 for new systems. Even our database is unable to read user passwords.
Sessions use signed JWTs issued by our API after argon2 password verification or successful OAuth round-trip with Google / LinkedIn. The OAuth callback URI points at our backend — not at the browser — so OAuth client secrets never reach the client. CSRF protection on the OAuth state parameter uses HMAC signing with the JWT secret, no server-side session table needed.
Every database table holding tenant data carries a tenant_id column, and every authenticated API route enforces the JWT's tenant_id at the query level. There is no SQL path that allows tenant A to read tenant B's widgets, conversations, leads, or usage data. This invariant is unit-tested at the route handler layer.
Card numbers, CVVs, and full PANs never touch our infrastructure. Razorpay (for INR) and Paddle (for USD and international, as Merchant of Record) handle every step of payment capture on their PCI-compliant hosted checkout pages. We store only the last 4 digits, brand, and gateway tokens — enough to display a saved card to the customer, never enough to charge one off-network.
Unexpected runtime errors (database unreachable, JSON parse failures, library throws) are sanitised before the response leaves the API. Internal SQL strings, parameter values, stack frames, and connection errors are replaced with a generic "Something on our end is misbehaving" message. The browser console logs nothing exploitable for an attacker; engineers see real errors in the server logs.
The embedded voice widget loads into a closed shadow DOM with all CSS inlined — it cannot read host-page state, cookies, or local storage by accident, and host-page CSS cannot leak into the widget. Mic access uses the standard browser permission prompt; we never bypass user consent for audio.
Per-IP rate limits (30 voice sessions per hour, 60 inline-capture submits per hour) bound the worst-case behaviour of a hostile script. Per-tenant outbound limits prevent a single customer from exhausting our quota with the upstream voice provider.
Customers who run authenticated experiences on their own site can pass a signed JWT through the widget to identify the visitor. The token is verified server-side with HS256 against the customer's own secret (generated per widget). Verified claims surface in conversation metadata for post-call CRM joining.
What we collect, where it lives, how long we keep it.
Account data (email, password hash, name), widget configuration, knowledge-base documents you upload, call transcripts + audio from voice sessions, IP address for geo-localized pricing display, and usage metrics for billing.
On a managed VPS in a single region we operate end-to-end. Voice audio + transcripts are stored by our voice provider (Retell) with encryption at rest; we read them via authenticated API only.
Account + billing data — for the life of the account, plus statutory retention for tax records (typically 7 years per Indian Income Tax Act). Call transcripts + audio — retained for the customer's active subscription period and 90 days after cancellation, then deleted.
EU residents can exercise GDPR rights (access, rectification, erasure, portability) via the contact channel below. The Indian Digital Personal Data Protection Act 2023 is in force; our handling aligns with its consent + notice + storage limitation principles.
For the legal-language version of this section, see our Privacy Policy.
Roadmap, not claims.
We're early enough that we'd rather tell you what we're working toward than over-claim. Here's the truthful state of certifications.
Responsible disclosure.
Found a security issue? We'd like to know about it before anyone else does. Email contact@aiandhumn.com with the subject line security disclosure and a brief description. We respond within one business day, will not pursue legal action against good-faith researchers, and will credit you in the fix announcement unless you prefer otherwise.
Last updated: 5 June 2026 — see also our Privacy Policy and Terms of Service.
Build on a platform you can trust.
Start free with a 14-day trial. No card required.
Create your voice widget →