Encryption
Chatevo encrypts data in transit and at rest using industry-standard algorithms and key management.
Encryption in transit
Section titled “Encryption in transit”All traffic between clients and Chatevo uses TLS:
| Connection | Minimum version | Notes |
|---|---|---|
| Dashboard ↔ API | TLS 1.2+ | HSTS enabled on all domains |
| Widget ↔ API | TLS 1.2+ | https://api.chatevo.ai only |
| Chatevo ↔ your tool APIs | TLS 1.2+ | Plain HTTP tool URLs blocked in production |
| Webhook delivery | TLS 1.2+ | HTTPS endpoints required |
We recommend TLS 1.3 on your webhook and tool endpoints for best performance.
Encryption at rest
Section titled “Encryption at rest”| Data | Method |
|---|---|
| Credentials | AES-256-GCM per-organization data keys |
| Knowledge base files | AES-256 server-side encryption in object storage |
| Database records | Encrypted volumes (AES-256) |
| Backups | Encrypted with separate backup keys |
| Secrets (JWT signing, webhook HMAC) | Managed secrets service; never in source code |
Credential plaintext is only decrypted in memory during tool execution and is never logged or returned via API.
Key management
Section titled “Key management”| Practice | Detail |
|---|---|
| Key rotation | Data keys rotated annually; credentials re-encrypted |
| Access control | Production key access limited to automated services |
| Separation | Backup keys distinct from primary storage keys |
Enterprise customers can inquire about customer-managed keys (CMK) via the DPA process.
What you should encrypt
Section titled “What you should encrypt”| Item | Recommendation |
|---|---|
| API keys in your CI/CD | Secrets manager, not repo |
| JWT signing secret | Server-side env var only |
| Webhook signing secret | Store alongside your webhook handler config |