Workspace isolation
Every desk and API query is scoped to your workspace. When our staff open a workspace to help, it's a separate, time-limited session that can't change billing.
Credentials
Passwords are hashed with bcrypt; API keys are stored only as hashes and scoped to what they may do. Channel tokens and webhook secrets are encrypted at rest (AES-256-GCM).
Payments
Card details never touch Frosvo: checkout and card management happen on Stripe's and PayPal's own pages.
Signed webhooks
Everything we send you is signed (HMAC-SHA256 with a timestamp); everything payment providers send us is verified before it's used.
Abuse protection
Rate limits on sign-in, sign-up, the widget and the API; outbound requests to customer URLs are checked so they can't reach private networks.
Retention and erasure
You choose how long conversations and anonymous visitors are kept. Export or erase one person's data on request.
Backups
Consistent nightly backups with checksums, kept off the server, and restore drills that prove they work.
Least access
Owners manage billing, API keys and integrations; agents answer conversations. Sensitive actions are recorded.