Security
How we handle your data.
Written for the person who has to sign off on us. No claims we cannot back up.
Infrastructure and encryption
- The application runs on managed edge infrastructure with automatic TLS. All traffic to HeySale is HTTPS only.
- Customer data is stored in a managed Postgres database with encryption at rest and encrypted backups.
- Secrets and API keys are held in an encrypted secret store and are never committed to source control or exposed to the browser.
Access control
- Every account's data is isolated at the database level with row-level security, so one customer cannot read another customer's agents, conversations, or leads.
- Public embed endpoints only serve an agent on domains the account has explicitly verified.
- Sensitive account actions — changing a salesperson, taking one live, and billing changes — are written to an append-only audit log visible in the dashboard under Activity.
Subprocessors
- Supabase — application database, authentication, and file storage.
- Cloudflare — application hosting and content delivery.
- Stripe — payment method storage and invoicing. HeySale never stores card numbers.
- Resend — transactional email delivery.
- AI and real-time avatar providers — used to generate agent responses and the spoken avatar stream.
What we collect from your visitors
- Conversation transcripts, the page the conversation started on, and any contact details the visitor chooses to share.
- Session duration, used to meter billable minutes.
- We do not sell visitor data and we do not use your conversations to train third-party models.
Retention and deletion
- Conversations and leads are retained for as long as your account is active so they stay available in your dashboard.
- You can request deletion of specific conversations, leads, or your entire account at any time; we complete deletion within 30 days.
- Billing records are retained as long as required for tax and accounting purposes.
Availability and incidents
- Agents fail safe: if a provider is unavailable, the agent stops rather than serving a broken or unbilled session.
- A watchdog runs every minute and force-ends any session that stops reporting in, so a dead browser tab can never keep billing.
- Security issues can be reported to security@hey.sale. We acknowledge reports within two business days.
Compliance status
- HeySale is an early-stage company. We are not SOC 2 certified today; the controls above describe what is actually in place.
- A Data Processing Agreement is available on request for customers in the EU and UK.