Your data is safe and secure.
- Encrypted in transit
- TLS 1.3
- Encrypted at rest
- AES-256
- Hosted on Microsoft’s cloud
- Microsoft Azure
- Backed up every day
- Automated backups
Security made simple.
You decide who sees what
Invite your team and give each person a role. Role-based permissions control who can view and change your chatbots and data.
Your data stays yours
We never sell your data, and we don’t use your conversations to train AI models without your permission.
Official Meta Business APIs
Hyperleap AI is a Meta Technology Provider and Business Partner. WhatsApp, Instagram, and Messenger run on Meta’s official Business APIs.
Technical details for your IT team or developer
Access and sign-in
Role-based permissions in every workspace. The workspace permissions matrix lists role-by-role rules for chatbots, tools, assistants, prompts, and personas. Single sign-on (SSO) and multi-factor authentication (MFA) are available on the Enterprise plan.
Webhooks and Actions
Webhooks (Pro and Max) send lead, conversation and booking events; payloads are HMAC-SHA256 signed, with delivery history. Actions (Pro and Max) call your API from our servers: credentials are stored encrypted and never shown to the AI or the visitor, and requests to private or internal addresses are blocked.
AI assistants over MCP
Claude, ChatGPT, and other assistants connect to the MCP server through a single OAuth sign-in with each person's own MCP key. Access is read-only, with one exception: extracting lead insights saves them to the lead's profile. Assistants can't send messages or change settings, and removing a person from your account ends all their connections.
Privacy and compliance.
We haven't had third-party audits or penetration tests, and we don't hold certifications such as SOC 2 or ISO 27001. What we do commit to is written down in the documents here.
- Data Processing AgreementHow we process personal data on your behalf under GDPR, including Standard Contractual Clauses for international transfers.
- Sub-processorsThe companies that process data for us, from cloud hosting to the AI model providers.
- Privacy policyWhat we collect, how long we keep it, and how to ask for your data to be deleted.
- Cookie policyWhich cookies this website uses, and the choices you have.
Need dedicated cloud deployment?
For businesses with strict data residency or security requirements, we offer dedicated cloud deployment to your own infrastructure on our Enterprise plan. Enterprise is also the plan for single sign-on (SSO) and multi-factor authentication (MFA).
Security questions answered.
Where is my data stored?
On Microsoft Azure. It is encrypted while stored and backed up automatically every day. If you need it on your own infrastructure, dedicated cloud deployment is available on the Enterprise plan.
Is Hyperleap AI GDPR compliant?
Yes. Hyperleap AI is GDPR compliant. Our Data Processing Agreement sets out how we process personal data on your behalf, including Standard Contractual Clauses for international transfers.
Who can access my customer data?
You and the teammates you invite. You give each person a role, and role-based permissions decide what they can view and change.
Do you use my data to train AI models?
No. We don’t use your conversations to train AI models without your permission, and we never sell your data. To write each reply, the conversation is processed by the AI model provider (OpenAI or Anthropic). They are listed with our other sub-processors on our sub-processors page.
Is my chatbot data encrypted?
Yes. Data is encrypted in transit with TLS 1.3 and at rest with AES-256. These are widely used, industry-standard encryption methods.
What about WhatsApp, Instagram, and Messenger messages?
Hyperleap AI is a Meta Technology Provider and Business Partner. WhatsApp, Instagram, and Messenger run on Meta’s official Business APIs, with no third-party relay in the middle. Once messages reach Hyperleap, they are encrypted in transit and at rest like the rest of your data.
Can I export or delete my data?
Yes. You can export your leads as a CSV or Excel file at any time, and you can ask us to delete your data. Some records may have to be kept for legal reasons; our privacy policy explains how deletion and retention work.
What happens if there’s a security breach?
If a breach affects your data, we will notify you without undue delay. Our Data Processing Agreement sets out the timeline and what the notice includes.
How do you handle payment information?
Your subscription is billed through established payment processors such as Stripe, which handle your card details. We don’t store your card details, and your AI agent doesn’t take payments from your customers.
Do you have third-party audits or certifications?
Not yet. We haven’t had third-party audits or penetration tests, and we don’t hold certifications such as SOC 2 or ISO 27001. We follow established security best practices: encryption in transit and at rest, automated daily backups, and role-based permissions.
How do I report a security vulnerability?
We welcome responsible disclosure from security researchers. If you find a vulnerability, please report it to security@hyperleap.ai and we will get back to you.
Have a security question not answered here, or found a vulnerability? Email security@hyperleap.ai.