All traffic to the Service is served over HTTPS/TLS. The app is HTTPS-only, with cleartext connections disabled and mixed content blocked.
Every workspace's data is isolated. Our data-access layer enforces workspace scoping on every query and fails closed — a query that isn't correctly scoped is rejected rather than allowed to cross workspaces.
Your AI-provider keys and channel tokens are stored server-side, shown masked in the portal, and never sent to a browser. Payment and messaging secrets are held server-side only.
One workspace's content is never used to answer another business's assistant, and is not used to train shared models.
Uploaded documents default to private: their content can inform an answer, but the original file or text is never downloadable by a visitor. Owners can lock individual sources or set the whole workspace private.
Passwords are stored only as salted PBKDF2 hashes (200,000 iterations) — never in plain text.
Optional TOTP-based 2FA is available for accounts and for platform operators; we recommend enabling it.
Platform staff access is governed by defined roles with the minimum permissions needed, and sensitive administrative areas can be restricted by IP allow-list and location checks.
Security-relevant actions — sign-ins and failed attempts, setting changes, payments, and administrative and support access — are recorded with timestamps and source IPs.
Requests are rate-limited and abusive patterns are throttled to protect availability and your data.
Every outbound fetch to a customer-supplied address — the knowledge crawler, sitemaps and RSS feeds, link ingestion, speech-to-text of linked media, connected-system lookups and lead webhooks — is blocked from private, internal, loopback and link-local ranges and from cloud metadata endpoints. Targets are resolved and pinned before the request, so a crafted or redirecting URL cannot pivot to internal systems.
Where an authorised operator accesses a workspace to help you — including signing in as your account for troubleshooting — that access is recorded in the activity log.
Card payments are processed by PCI-DSS-compliant providers (Paystack, Stripe). We do not store full card numbers.
You can enable 2FA, set conversation retention, erase conversations and data permanently, export your data, and review your activity log at any time.
An assistant that reads the open web can be attacked through the content it reads. Anyone able to place text on a page you crawl — a product review, a forum comment, an agency with CMS access — is otherwise writing directly into the assistant's instructions. We treat every ingested passage as untrusted and defend it in layers, with the load-bearing layers deterministic rather than dependent on a model behaving well.
Command lines and control tags that our own code would parse and act on are made inert as content is ingested, and again whenever a knowledge base is rebuilt. This does not rely on the AI recognising an attack.
Knowledge passages are supplied to the model inside delimiters carrying a random per-request reference, so ingested text cannot imitate the boundary and impersonate the operator's instructions.
The grounding gate removes retrieved content before scanning for the tags that change request handling, so a control signal is never read out of untrusted data — including from knowledge bases built before this shipped.
Instruction-shaped prose is counted and surfaced to the workspace owner with the categories found, because a legitimate page may discuss the subject. Diagnostic samples are themselves neutralised before storage.
You own your content. You can export your leads, conversations and content, and delete conversations and other data permanently, from the portal. When you close your account we delete or de-identify your content within a reasonable period, except where retention is required by law. See the Privacy Policy for details.
We welcome reports from security researchers. If you believe you have found a vulnerability, please email security@temira.net (or use the Contact page) with enough detail to reproduce it. Please:
Safe harbour: if you make a good-faith effort to comply with this policy, we will not pursue or support legal action against you for your research, and we will work with you. We do not currently operate a paid bug-bounty, but we gratefully acknowledge valid reports.
We monitor for security issues and maintain an incident-response process. If a personal-data breach affecting you occurs, we will notify affected customers and, where required, the relevant authorities, within the timeframes applicable law requires.
We work hard to protect your data, but no product, method of transmission, or method of storage is completely secure. This page describes controls, not guarantees; nothing here creates a warranty beyond what our Terms provide. You are responsible for securing your own credentials, devices, connected accounts, and how your team uses the Service.