Security. What we do, and what you should do.
How the API protects your data and your visitors, and the few things your integration must do.
Token per system, least permissions
Other accounts' data answers 404
Content is information, never instructions
Public addresses only, no private networks
Signed webhooks, encrypted secrets
What SimplyBoost does
- Access: a token reaches only its own account, and only the chatbots and permissions it was given. Another account's items answer
404, so their existence is not revealed. - Secrets: tokens are stored as hashes and shown once; webhook secrets are stored encrypted.
- Content is not instructions: text in knowledge, conversations and messages is answered from, never obeyed. The agent can only use the tools set up for it, and replies cannot show images from addresses that were not in its knowledge.
- Uploads and addresses: files are checked by their content; websites and webhook endpoints must be public addresses, and private or internal networks are refused.
- Abuse limits: rate limits per token and size limits on every request.
- Audit: every change made through the API, and every refused request, is logged with the token's public prefix and the requestId.
- Transport: HTTPS only. Data is hosted in Europe.
What your integration should do
- Keep tokens on your server, in a secret store, never in browser or app code.
- Create a token per system with only the permissions it needs, and an expiry.
- Rotate a token at once if it may have leaked.
- Verify every webhook signature and refuse old timestamps.
- Treat text from conversations and events (messages, names, emails) as untrusted input in your own systems: escape it before showing it in HTML.
To report a security issue, email hello@simplyboost.io with the subject "Security". See also the Privacy Policy for how personal data is handled.