Security
Last updated: June 28, 2026
Security Overview
CollowAI takes security seriously. We implement industry-leading security practices to protect your data, your customers' data, and your AI assistants. Our platform is built with security-first architecture across every layer.
Encryption
All data is encrypted in transit using TLS 1.3 and at rest using AES-256. Database connections use encrypted tunnels. API keys and credentials are encrypted with AES-256-GCM and never stored in plaintext. All HTTPS connections enforce HSTS.
Infrastructure Security
Our infrastructure runs on secure data centers with 24/7 physical security and environmental monitoring. We use isolated tenant environments to prevent cross-customer data access. Data centers provide physical security, biometric access controls, and environmental monitoring.
Access Controls
Role-based access control (RBAC) ensures team members only access what they need. Admin actions require re-authentication. All access attempts are logged in our audit trail.
Data Isolation
Each customer's data is logically isolated. Your documents, knowledge bases, database connections, and conversation history are completely separated from other tenants. AI models are never trained on your data.
AI Safety
Your uploaded data is used exclusively to power your AI assistants. We do not use customer data to train, fine-tune, or improve general AI models. Prompt injection protection is built into our AI pipeline.
API Security
API keys are rotatable and can be scoped to specific endpoints. Rate limiting prevents abuse. All API requests are authenticated and logged. Webhook payloads are signed with HMAC-SHA256 for verification.
Widget Security
The embeddable widget loads in a sandboxed iframe with strict Content Security Policy headers. It cannot access your page's DOM, cookies, or local storage. The widget origin is isolated from your site.
Monitoring & Auditing
We maintain comprehensive audit logs of all administrative actions, API calls, and data access. Real-time monitoring detects anomalies. Incident response procedures are documented and tested regularly.
Compliance
We implement strong security measures including encryption, access controls, and audit logging. We offer Data Processing Agreements (DPAs) and comply with GDPR, CCPA, and other applicable privacy regulations. SOC 2 compliance is in progress. HIPAA BAAs are not currently offered.
Vulnerability Management
We conduct regular security assessments. Dependencies are monitored for known vulnerabilities via automated scanning. Critical patches are applied promptly after disclosure.
Incident Response
We maintain a documented incident response plan with defined escalation procedures. In the event of a security incident, affected customers are notified promptly. Post-incident reports are shared with affected parties.
Bug Bounty
We welcome responsible disclosure of security vulnerabilities. If you discover a security issue, please report it to security@collowai.com. We will respond within 48 hours and work with you to understand and address the issue.
Contact Security Team
For security inquiries or vulnerability reports, contact our security team at security@collowai.com.