01 Security

Built for teams that cannot afford to guess

Encryption, tenant isolation, audit logging, and a public subprocessor list. Last updated September 2, 2026.

02 Controls

Security pillars

Control How it works

Encryption everywhere All data is encrypted in transit (TLS 1.2+) and at rest (AES-256) via our infrastructure provider, Supabase (PostgreSQL on AWS). Widget-to-server traffic and dashboard sessions are HTTPS-only.

Tenant isolation Every API route that reads or writes tenant data asserts ownership before touching the database. No workspace can read another workspace's conversations, visitors, or settings, enforced at both the application layer and Postgres Row-Level Security.

Widget authentication The embed script signs requests with HMAC using your property secret. Unsigned or tampered widget payloads are rejected before they reach the database, preventing spoofed visitor sessions.

CSRF and rate limiting Dashboard mutations use double-submit CSRF tokens. All API routes apply per-IP rate limits to prevent abuse, and widget endpoints validate allowed domains before accepting traffic.

Enterprise SSO and MFA Enterprise customers can enforce SAML 2.0 single sign-on for their whole team. Every user, on any plan, can additionally enable TOTP-based two-factor authentication on their account.

Full audit trail Every settings change, data export, team member action, and admin action is written to an immutable audit log, viewable by workspace owners under Settings → Security → Audit Log.

Least-privilege access Internal access to production data is limited to the on-call engineering team and logged. Team members you invite get scoped roles (owner, manager, agent, viewer), not blanket access.

Data retention and deletion Workspace owners can export or delete visitor data on request. GDPR data-subject requests are handled via privacy@pengo.chat with documented SLAs.

Vetted subprocessors We only send data to subprocessors that meet our security bar (see the list below) and only for the specific purpose disclosed, e.g. transactional email delivery, AI inference for the copilot, payment processing.

03 Compliance

Compliance

We build to SOC 2-aligned controls today: encryption, access logging, change management, and tenant isolation as described above. We are formalizing these into a SOC 2 Type II audit and will publish our report here once it is complete. In the meantime, our security team is happy to complete a vendor security questionnaire for your procurement process.

GDPR: we support data export and deletion requests for any visitor or team member. See our Privacy Policy for details, or reach out to privacy@pengo.chat.

04 Vendors

Subprocessors

Vendor Purpose Location

Supabase Database, authentication, file storage AWS (region selected at signup)

Vercel Application hosting Global edge network

OpenAI AI copilot, bot responses, and lead qualification United States

Stripe Payment processing and billing United States / EU

Resend Transactional email delivery United States

Twilio SMS and WhatsApp messaging (if enabled) United States

05 Response

Incident response and reporting

Incident response

If we discover a security incident affecting your data, we notify affected workspace owners by email within 72 hours of confirmation, with what happened, what data was involved, and what we are doing about it, consistent with GDPR breach notification requirements.

Report a vulnerability

Found a security issue? We want to know. Email us and we will respond within one business day.

security@pengo.chat

Questions about security?

Start free trial Talk to sales

7-day free trial · Card required · Cancel anytime