Trust & Security

All traffic uses TLS 1.2 or higher. Data at rest is encrypted at the storage layer. Access tokens for connected Google, Meta, and WhatsApp accounts are additionally encrypted with AES-256-GCM before they are stored, are never logged, and are never sent to the browser. The table holding them cannot be read by app users at all.

Every business-scoped table has Postgres row-level security with explicit policies, and application queries are also scoped by business. One business's data can't be queried by another at the database or application layer.

Each business's agents run under their own restricted identity, subject to the same row-level security as a user. They can only reach that business's data, and they can't change billing, settings, or connections. The agent worker holds no database master key.

Each agent can only use the specific actions it needs — for example, the review agent can reply to reviews but can't publish posts or message customers. Every action is recorded in the business's activity log along with who approved it.

Messages, comments, and reviews from the public are treated as untrusted input. Agents can only reply within the conversation they came from, take prices and stock only from your inventory, and send anything unusual to you for approval instead of acting on it.

Approvals happen only inside the Trackye app, by the signed-in business owner. Notifications link into the app but can't approve anything themselves.

Access to production systems is limited to authorized personnel and logged. Each business has one owner login; only the owner can approve actions and change settings.

Sign-in, public forms, webhooks, AI calls, and outbound messages are rate-limited per IP address and per account or business using Upstash Redis, so a flood of requests can't run up costs or spam customers.

Server logs are structured and pass through automatic redaction of authorization headers, cookies, emails, phone numbers, and access tokens. We don't log message bodies or raw platform responses.

Report vulnerabilities to security@trackye.com with enough detail to reproduce them. Please don't test against other businesses' data, attempt denial of service, or disclose publicly before we've had a reasonable chance to fix the issue. We aim to acknowledge reports within 2 business days.

Confirmed incidents affecting customer data are triaged immediately. Affected businesses are notified without undue delay, and within 72 hours, as set out in our Data Processing Agreement.

Trackye is SOC 2 ready: our controls — encryption, access control, business isolation, logging, and incident response — are built to the SOC 2 Trust Services Criteria. Customers needing a signed DPA or security questionnaire can request one from security@trackye.com.