Privacy and security

Your feedback often contains customer names, emails and revenue. This article describes the protections built into CustomerSaid. It is a summary, not a certification.

CustomerSaid is not SOC 2 certified, and we do not claim it is.

Workspace isolation

Each workspace is a separate tenant. The database enforces row-level security, so a workspace can only reach its own rows, even if a bug elsewhere asked for more. Every request also re-checks that you are an active member and hold the permission for the action.

Access control

Roles and permissions decide what people can see and do, and revenue has its own permission. Actions are checked on the server, not only in the interface. Removing a member cuts off their access, their paired devices and their AI agents. See Roles and permissions.

Credentials and secrets

Integration tokens and keys are encrypted at rest. Invitation links, device codes and AI agent tokens are stored only as hashes, and invitations expire after seven days. OAuth connections use short-lived, single-use sign-in state tied to your browser session.

AI and your data

• Customer text is treated as untrusted data. It is fenced in prompts so a quote cannot give the AI new instructions.
• Quotes are checked against the original text. Unsupported claims are dropped.
• AI runs only on your request or as part of processing your feedback, and results stay inside your workspace.
• Stored AI inputs and outputs are cleared after a retention period. See Data retention and deletion.

Crawling and fetching

When you add a website as product context, CustomerSaid only fetches public HTTPS pages, blocks private and internal addresses, respects robots.txt and sends no cookies or credentials.

Audit trail

Important changes, such as decisions, merges, status changes, connections and approval and revocation of AI agent access, are recorded in an audit trail. History is append-only.

The public demo

The demo workspace is a read-only sample with synthetic data. Do not enter confidential information there.

Your responsibilities

• Give people the lowest role that fits their job.
• Keep revenue permission to those who need it.
• Revoke devices and AI agents that are no longer used.
• Do not paste secrets or passwords into feedback.

Questions

For a security questionnaire or a specific request, contact us.