Workspace isolation
Customer data, conversations, integrations and configuration are scoped to the merchant workspace.
Security
Trustworthy automation starts with clear boundaries.
Chatout is designed around workspace isolation, encrypted credentials, verified integration events, backend validation and merchant control.
Security model
Workspace-scoped customer data
Encrypted integration credentials
Signature-verified webhooks
Idempotent message processing
Merchant-controlled automation
Security principles
Protect the workspace. Limit integration access. Keep merchants in control.
Least-privilege integrations
Integration access is limited to the permissions required by the product workflow.
Encrypted credentials
Integration credentials and access tokens are encrypted at rest.
Human control
Merchants can inspect conversations, pause automation and explicitly take over.
Reliable event processing
Webhooks are acknowledged before expensive work begins.
Integration events are verified, persisted and processed through controlled backend workflows rather than calling the AI or commerce system directly in the webhook request.
Verified webhook intake
Inbound integration webhooks are signature-verified before trusted processing begins.
Idempotent processing
Duplicate events are handled so the same webhook does not create duplicate customer actions.
Backend validation
Customer-visible actions are validated by the backend instead of allowing the AI unrestricted control.
Checkout stays with the merchant.
Chatout is not a payment gateway and does not process buyer payment credentials.
Chatout can share the merchant's existing checkout handoff.
Buyer card and payment credentials remain with the merchant commerce provider.
Chatout does not report payment status unless it comes from an authoritative integration.
Security transparency
Chatout is in early access and does not currently claim formal security certifications. Security practices continue to be strengthened as the product moves toward general availability.