Security you can explain to your DPO

Architecture

ChatMesh runs as stateless API nodes behind a load balancer, with PostgreSQL as the system of record and Redis pub/sub fanning out real-time events to every connected agent and visitor. Slack, Discord and webhook deliveries run through a durable job queue, so a slow or unavailable third party never blocks a conversation, and failed deliveries are retried safely. Any node can be replaced at any time without losing data.

Widget isolation

• The widget renders inside a Shadow DOM, isolated from your page’s styles and markup.
• Messages are treated as plain text and never rendered as HTML, preventing cross-site scripting through chat content.
• Each visitor gets a token that grants access only to their own conversation. Internal notes are never sent to visitors.
• Allowed origins let you restrict which websites may load your widget.

Integrations and automation

• Integration credentials are stored encrypted at rest and are never shown back in the portal.
• Outbound webhooks are signed with HMAC-SHA256 and include a timestamp, so you can verify authenticity and reject replays.
• Webhook URLs must use HTTPS.
• AI agents act through API keys, and every AI message is labelled and attributed, so your team can always see — and take over — what an AI has said.

Operational security

• Rate limiting on authentication, widget and API endpoints.
• Access to production systems is restricted to a small number of authorised staff, protected by multi-factor authentication.
• Dependencies are kept up to date and monitored for known vulnerabilities.
• Payment card data is handled entirely by Stripe; it never touches our servers.

This website

chatmesh.ascend-digital.co.uk is a static site with no cookies, analytics or third-party requests. It ships a strict Content Security Policy, HSTS, and a full set of modern security headers.

Privacy and compliance

We act as a processor for the conversations you hold in ChatMesh. Our data processing terms apply to all customers, and Enterprise customers can request a countersigned DPA. See also our privacy notice.

Reporting a vulnerability

If you believe you’ve found a security issue, please email security@chatmesh.io with details and steps to reproduce. We’ll acknowledge your report within three business days and keep you updated. Please don’t access other customers’ data, degrade the service or publicly disclose the issue before we’ve had a reasonable chance to fix it. We won’t take legal action against good-faith research that follows these guidelines. Our security.txt has the details in machine-readable form.