Security

Your data, handled with care

Q: Can we get a security questionnaire answered?

Yes. Email security@rabbitblaze.com with your questionnaire and we’ll fill it in.

How we protect the conversations, contacts and content you trust us with, from encryption and access control to how Blaze uses AI.

Report a vulnerability Read the DPA

2FA on every plan Encrypted in transit and at rest No AI training on your data

Infrastructure and encryption

Encrypted on the way in, at rest and in our backups.

Every connection uses TLS 1.2 or newer, with strict certificate validation all the way to our servers.
Attachments, images and exports are stored encrypted at rest with AES-256.
Secrets such as two-factor seeds, identity verification keys and webhook signing secrets are encrypted with AES-256-GCM.
API keys are stored only as SHA-256 hashes, and files are served through signed, expiring links.
Daily database backups are verified after every run and kept with a separate provider.

Accounts and access

Strong defaults for every teammate, on every plan.

Passwords are hashed with Argon2 and never stored or logged in plain text.
Two-factor authentication with any authenticator app.
Sessions live in HttpOnly, Secure cookies, and requests from other websites are rejected.
Rate limits and temporary lockouts stop password guessing.
Owner, admin, agent and viewer roles, plus an audit log of sensitive changes.

Application security

Every request checked, every workspace kept apart.

Every request is validated and authorized against the workspace it belongs to.
HTML from customers and teammates is sanitized before it’s stored or shown.
Website crawling, webhooks and workflow HTTP requests can’t reach private networks.
Outgoing webhooks are signed with HMAC-SHA256 and a timestamp.
Messenger identity verification and allowed domains stop people from impersonating your customers.

AI and your data

Useful AI, without giving up control of your data.

We never train AI models on your data or your customers' conversations.
Blaze and Copilot use an enterprise AI service on paid terms that don’t allow your prompts or answers to be used for training.
Blaze answers only from content you connect, and you choose which sources Blaze and Copilot may use.
Before Copilot learns from past conversations, contact details, card numbers and secrets are redacted.
Prompts are built to resist injected instructions, and repeated attempts are handed to your team.

Subprocessors

Who helps us run Rabbitblaze

A short list of providers, each bound by data protection terms. We’ll tell workspace owners at least 30 days before adding a new one.

Rabbitblaze subprocessors
Provider	Purpose	Location
Hetzner	Application hosting and databases Germany (EU)	Germany (EU)
Cloudflare	DNS, content delivery, network security and backup storage Global network	Global network
Backblaze	File storage United States	United States
Resend	Email sending and receiving United States	United States
AI model provider	AI processing for Blaze and Copilot United States	United States
Stripe	Card payments (billing data only) United States	United States
PayPal	PayPal payments (billing data only) United States	United States

Compliance

Privacy law and certifications

Where we stand today, stated plainly.

GDPR and UK GDPR

Our Data Processing Addendum applies automatically and includes the Standard Contractual Clauses for international transfers.
Read the DPA
CCPA

We act as a service provider. We don’t sell personal information or share it for cross-context advertising.
Read the privacy policy
Payments

Card and PayPal payments are handled by Stripe and PayPal. We never see or store full card numbers.
Certifications

We aren’t SOC 2 or ISO 27001 certified yet, and we don’t support HIPAA. We’re happy to answer security questionnaires.

Responsible disclosure

Found a vulnerability? Tell us.

We welcome reports from security researchers. We’ll confirm we’ve received yours, keep you updated while we fix it, and won’t take legal action against research done in good faith under these guidelines.

[email protected] security.txt

01
Email the details to [email protected], with the steps to reproduce the issue and its impact.
02
Only test against your own workspace. Don’t access, change or delete data that isn’t yours.
03
Don’t degrade the service for others: no denial-of-service, spam or social engineering.
04
Give us reasonable time to fix the issue before telling anyone else.

FAQ

Questions, answered

Something else on your mind? We read every message.

Where is our data stored?

Your workspace’s data lives on Hetzner application servers and databases in Germany (EU), and files are stored with Backblaze in the United States. Cloudflare’s global network delivers and protects our sites.

Can we delete our data?

Yes. You can delete contacts at any time, and owners can delete the whole workspace. After a workspace is deleted, we remove its data from our live systems within 30 days and from backups within 90 days.

Do you support single sign-on (SAML)?

Not yet. Every plan includes two-factor authentication, and owners and admins control who has access through roles. SAML single sign-on is on our list.

Can we get a security questionnaire answered?

Yes. Email [email protected] with your questionnaire and we’ll fill it in.

Secure by default, on every plan

Two-factor authentication, roles, audit logs and encryption come with the Free plan too. No card needed to start.

Start free Talk to us