"Secure" is one of those words every vendor uses and few explain. Here's what it should actually mean in practice, and how to verify it rather than take it on faith.
Any credential your chatbot platform stores on your behalf — a Slack token, a CRM access token, a connected social media account — should be encrypted at rest, not stored as plain text in a database. This is a specific, checkable claim, not a vague one.
If the platform serves multiple businesses from one backend, ask exactly how your data is separated from another client's — by database row, by schema, or something weaker. A vendor that can answer this precisely has actually thought about it.
Rate limiting on login attempts, session handling that doesn't leave old sessions valid indefinitely, and webhook signature verification for anything receiving inbound data are all unglamorous details that matter more than marketing copy about "enterprise-grade security."
Every client is fully isolated at the data level, every stored credential is AES-256 encrypted, and login is rate-limited against brute-force attempts. We're honest that things like a third-party compliance certification (SOC 2) aren't built yet — see our comparison page for the full, unvarnished picture against other platforms.