Security and privacy
Private by default, verified on every release.
Gavvio holds conversations, contacts and sales of agencies' clients. This page describes, in concrete terms, how that data is isolated, protected and deleted. The legal details are in the Privacy Policy.
Isolation per client
- Every customer-data table carries the organization and workspace identifiers, and every query is filtered by them through a mandatory middleware — by construction, not by discipline.
- Automated isolation tests run on every change, with thousands of cross-tenant access attempts per module, and fail the build if one gets through.
- Restricted roles (chat agent, comment moderator, viewer) only reach the screens of their role; every new route has to be allow-listed explicitly.
Encryption and secrets
- Integration tokens (Meta, Google, TikTok, Stripe and others) and 2FA secrets are encrypted at rest with AES-256-GCM; passwords use bcrypt.
- Traffic is always over TLS; the application sits behind Cloudflare's network, and the servers expose no database ports.
- Provider errors are never stored with the token inside them; personal data stays out of audit rows and internal e-mails.
Webhooks and external input
- Every provider webhook is verified by signature (HMAC) before any processing; a payload without a valid signature is dropped.
- Connections to services you host yourself go through an allow-list of destinations, so the platform cannot be used to reach internal networks.
- Uploads have their type checked by content, not by extension.
Data lifecycle
- Account deletion with a 30-day recovery window and then a full purge of every table — purge coverage is checked at build time.
- Disconnecting a channel deletes the token immediately and revokes it at the provider where the API allows.
- Retention per category: access logs for 12 months, tax records for 5 years, backups rotated within 90 days.
- Data-subject requests (access, correction, portability, deletion) through the data protection officer's e-mail, answered within 15 days.
Operations
- Hosted at Hetzner (Germany), PostgreSQL with daily backups and tested restores.
- Automated deployment from versioned code, with migrations checked before every release and rollback per release or per feature.
- An audit log for sensitive actions: billing, members, channel connections, contact merges, deletions.
What we never do
- We do not use customer content to train models, nor share data with third parties for that purpose.
- We do not merge contacts automatically; duplicates are suggested and a person confirms.
- We do not send test events to customers' ad platforms.
- We set no marketing or tracking cookies on this site.
Found a vulnerability? Write to [email protected] with the subject "Security". We answer within 5 business days and take no legal action against good-faith reports.
Questions about security or compliance?
Talk to the team. We answer security questionnaires and data processing agreement (DPA) requests.
No credit card needed to start.