Security Measures

1. Purpose of This Notice

This page summarizes Chat4U's current security measures at a customer-facing level. It describes verified, scoped controls and risk-reduction measures. It does not disclose sensitive implementation detail.

This notice is not a warranty that any control is perfect, universal, or appropriate for every customer use case.

---

2. Shared-Responsibility Model

Chat4U operates a cloud-hosted AI SaaS platform. Security is a shared responsibility.

Chat4U is responsible for the security of platform components we operate and control, subject to the limits of our architecture and service providers.

Customers are responsible for:

• website and application security on their own properties;
• user access decisions and internal account hygiene;
• prompts, data sources, uploaded content, and agent behavior;
• external integrations and provider-key handling;
• visitor notices, consent flows, and workflow suitability.

---

3. Access Control and Authorization

Current platform controls include:

• authenticated account access through our identity provider;
• role-based access controls within the application;
• workspace, project, agent, and datasource scoping in application logic;
• controlled administrative access for support and operational tasks;
• customer-managed user and organization membership.

We do not represent that every action can be safely delegated without review. Customers should configure roles and permissions conservatively.

---

4. Logical Tenant Isolation

Chat4U uses application-level tenant isolation in shared cloud infrastructure. Workspaces, projects, agents, data sources, and conversation data are separated through authorization, resource scoping, and correct customer configuration.

This reduces the risk of cross-customer exposure but does not eliminate all possible security risk. Customers share underlying database and infrastructure resources; isolation depends on application enforcement, not dedicated per-customer databases.

---

5. Data Protection and Encryption (Scoped)

Where implemented and verified, current measures include:

• HTTPS/TLS on public API, dashboard, and marketing endpoints;
• encryption at rest for managed database (RDS) and object storage (S3) where enabled in production configuration;
• application-level protection for stored provider credentials and platform secrets (e.g. SSM SecureString);
• access restrictions to production systems and administrative tooling;
• deletion workflows and lifecycle management for certain data categories.

This notice does not claim that:

• every category of data is encrypted in every state;
• every network path (including internal cache/queue layers) uses identical protections;
• any single protective measure applies universally across every provider integration.

Internal cache and queue services may not use transport-layer encryption; public-facing claims are limited to verified scoped controls above.

---

6. Logging, Monitoring, and Abuse Prevention

Chat4U maintains operational logging and monitoring to support reliability, troubleshooting, abuse prevention, and security investigation.

Depending on the system component, logs and telemetry may include request metadata, authentication events, rate-limit events, scrape and indexing operations, billing events, legal acceptance events, privacy-request events, and error records.

Logging improves visibility but does not guarantee detection of every incident or misuse pattern. CloudWatch alarms may notify operators when configured with a verified recipient.

---

7. Secure Development and Change Control

Current engineering practices include controlled source management, code review, automated build or test steps where available, and deployment workflows designed to reduce accidental change risk.

We do not state in this notice that every code path has comprehensive automated test coverage or that every change receives the same level of review.

---

8. Third-Party Providers

Chat4U uses third-party providers for identity, AI inference, embeddings, payments, email, and infrastructure. A published subprocessor list describes categories of providers involved.

Customer content may be processed by these providers according to their terms and our contractual arrangements. Third-party handling is not uniform; customers should review the subprocessor list and provider terms relevant to their use case.

---

9. AI, RAG, and Pro Agent Safeguards

AI features introduce distinct risks, including hallucination, prompt injection, unsafe tool behavior, and unexpected output.

Current risk-reduction measures may include:

• retrieval-augmented generation (RAG) to ground responses in customer-indexed content;
• optional guardrail features (input/output checks);
• plan and feature gating;
• request queues and rate limiting;
• tool approval defaults for higher-risk browser actions in Pro Agent;
• URL allowlisting in supported Pro Agent flows;
• deny selectors and browser-side redaction for common sensitive fields in Pro Agent snapshots.

These measures are risk reducers, not guarantees. They do not make outputs correct, lawful, complete, or appropriate for sensitive or regulated workflows. AI responses are not universally verified or corrected before display.

---

10. Training and Model Use

Chat4U does not train a cross-customer or general-purpose AI model on customer content for its own model development. Third-party provider handling of submitted content depends on the published provider terms and customer configuration (including customer-managed API keys where supported).

---

11. Customer Responsibilities for High-Risk Uses

Customers must not use Chat4U for high-risk or regulated use cases contrary to our Agreement documents unless Chat4U has granted a written Enterprise exception.

Customers remain responsible for use-case assessment, visitor disclosure, human review, and deciding whether any workflow is appropriate for AI assistance.

---

12. Security Incidents

If you believe your Chat4U account or project has been affected by a security issue, contact support@chat4u.ai.

Chat4U maintains a manual incident response process for operators. This notice does not create a standalone incident-response SLA, breach-notification timeline, backup guarantee, recovery objective, certification claim, or formal vendor-assessment commitment beyond what is stated in our contracts and applicable law.

---

13. Government and Law-Enforcement Requests

Chat4U reviews government and law-enforcement requests according to applicable law. We do not publish a transparency report at this time. Requests are handled manually; customers may be notified when permitted by law and contract.

---

14. Vulnerability Reporting

Security vulnerabilities may be reported to support@chat4u.ai. We do not operate a public bug bounty program or publish guaranteed response timelines in this notice.

---

15. Changes to This Notice

We may update this notice as our controls, product behavior, infrastructure, or legal requirements evolve. The version and last-updated date identify the current published notice.

---

16. Contact

Security-related questions: support@chat4u.ai

Privacy-related questions: privacy@chat4u.ai