Security and data

Where your customers’ conversations go

If you run a clinic, a school or a professional practice, somebody has to answer this before you can sign anything. Here is the whole answer, including the parts that are ordinary.

The four that matter

Every one of these is enforced by the database rather than by code remembering to do it. That is the difference between a promise and a guarantee.

One business cannot see another's data

Every table is protected by row-level security in the database itself, not by application code remembering to filter. That distinction is the whole thing: a query that forgot its filter returns nothing rather than somebody else’s customers. It is the one thing we hold an automated test suite for, run against a real database on every change.

Our own staff cannot read your conversations

Not for support, not for billing, not while looking at your account. When we open a support view of a client, the tables holding messages, leads and private notes are excluded from it, by the same database rules, so it is not a promise we could quietly stop keeping. Your transcripts are yours.

Nothing is used to train a model

Your customers’ messages are sent to the AI provider to produce that one answer and for nothing else. We do not sell data, and we do not build a model out of your business.

Contact details are hidden by default

Phone numbers and email addresses are masked in the transcripts your team reads, so somebody answering a question does not need to be handed a customer’s number. They appear in full on the leads screen, where getting back to the person is the point. You can turn the masking off.

The ordinary details

Where it is stored: Our database, file storage and sign-in run on Supabase, hosted in the EU. Answers are generated by an AI provider whose processing may happen outside that region. We keep what is sent to it to the question being answered and the material you gave us.
Who you are trusting: Sublex Chat is the processor and you are the controller: they are your customers, and the data is yours. Our subprocessors are listed in the privacy policy: the database and sign-in, the hosting, the AI and search providers, the email service, the payment provider, and error monitoring.
How long it is kept: For as long as you want it. Retention is a setting on your account: choose a period and conversations older than it are deleted automatically, along with the leads and messages attached to them. It is off by default, which means nothing is deleted until you say so.
Card details: We never see them. Payments run through Paddle as merchant of record; card numbers are entered with them and never reach us.
What we never put in an email: A customer's message. Notifications tell you a conversation needs a person and link to it behind your sign-in, and the transcript stays where it belongs. The same rule covers our error reports, which have request bodies, cookies and headers stripped out before they leave our servers.
Addresses: We rate-limit abuse using a one-way hash of a visitor's network address. The address itself is never stored in a form anyone can read.

What we have not built yet

Data residency inside your own country, single sign-on, and a signed uptime commitment are all real requests and none of them exists today. If your organisation needs one before it can buy, say so and we will tell you honestly whether and when, rather than after you have signed.

The formal versions of all of this are in the privacy policy and the data processing addendum. A question they do not answer is worth asking us directly: info@sublexdigital.com.