Security & Privacy
Built to protect your data
Every layer of SolarisChat from Instagram tokens to payment processing is designed with security first. Here is exactly how we protect you.
Instagram Connection & DM Security
How we handle your Instagram account and messages
OAuth. We Never See Your Password
Official API
Instagram handles authentication
You log in directly on Instagram's servers via OAuth. SolarisChat never receives or stores your password, we only get a secure access token.
Encrypted access token storage
Your Instagram access token is encrypted at rest using AES-128-CBC and can only be used by the app to send replies on your behalf.
Revoke access anytime
You can disconnect SolarisChat from your Instagram account at any moment from your SolarisChat dashboard or directly from Instagram's app settings.
Direct Message Encryption
Encrypted
AES-128-CBC encryption
Every DM stored in our database is encrypted using AES-128-CBC. Raw message text is never saved in plain form.
HMAC-SHA256 integrity check
Each encrypted payload is tagged with an HMAC-SHA256 signature to detect and reject any tampering before decryption.
URL-safe base64 key format
Encryption keys use a URL-safe base64 encoding, ensuring safe transport and storage without exposure.
Data Lifecycle & Auto-Deletion
What happens to your DM data from arrival to deletion
7-Day Automatic Purge Policy
Auto-deleted
DM arrives via Instagram Webhook
Instagram sends the message payload to our secure endpoint over HTTPS/TLS.
Encrypted and stored in database
The payload is encrypted with AES-128-CBC and tagged with HMAC-SHA256 before being saved. No one can read it in plain text.
AI pipeline processes the message
To write the reply, the message text, and any photo or voice message the customer sent, is passed over TLS to our AI model provider (OpenRouter). It is used only to generate that reply, never sold or used for advertising.
Reply sent back via Instagram Graph API
The AI-generated reply is sent using your encrypted access token. The response goes through Instagram's official API only.
Permanently deleted after 7 days
Messages and webhook data are automatically and irreversibly purged on day 7. Leads and orders stay until you delete them or close your account, so you can follow up with customers.
Minimal retention by design. We retain DM data only as long as strictly needed for the AI pipeline. After 7 days, it is deleted permanently.
Payment Security
Cards go through Paddle, transfers through your bank. We never touch your card
Paddle checkout and bank transfers
PCI Compliant
We never store your card details
Card details are entered on Paddle's secure checkout. SolarisChat never sees, handles, or stores card numbers or CVVs.
Paddle is PCI DSS Level 1 compliant
Paddle is our Merchant of Record and meets the highest security standard of the card industry. It processes card payments, taxes, and invoices for us.
Bank transfers: online banking, Kaspi, and MBank
You can also pay by bank transfer. The payment goes through your own bank; we only record that it arrived so we can activate your plan. We never ask for your banking login.
Only billing references on file
For card payments we keep only Paddle's customer and subscription IDs, with the customer ID encrypted. They identify your subscription and can't be used to charge you outside Paddle.
Webhook signature verification
Every billing event from Paddle is checked against Paddle's HMAC-SHA256 signature before we act on it, so billing updates can't be spoofed.
Account & Personal Data
How your profile, phone, and sensitive fields are stored
Encrypted Sensitive Fields
Phone number is encrypted at rest
Stored in an encrypted column. Not accessible in plain text even from the database directly.
Passwords are hashed, never stored
Passwords use PBKDF2-SHA256 hashing. We store only the hash, even our own team cannot recover your password.
Lead and order data is encrypted
Instagram usernames and IDs from leads, and the names, phone numbers, and addresses customers give when ordering, are stored encrypted.
Account Control
Delete your account anytime
A single action from your account settings permanently erases your profile, tokens, conversations, products, and billing history.
Submit a data deletion request
If you only want personal data erased without closing your account, you can submit a formal GDPR deletion request and we'll act within 30 days.
Images on Cloudinary, not our servers
Profile and product images are stored on Cloudinary, not on SolarisChat database servers.
Transport & Infrastructure
Secure channels and async architecture
Architecture Security
Always-on
HTTPS / TLS everywhere
All traffic between your browser, Instagram's API, and our servers is encrypted in transit.
Async Celery worker processing
Message pipelines run in isolated async workers. A crash in one conversation cannot affect another.
Redis debounce guard
Rapid successive messages are deduplicated via Redis so the AI never processes the same message twice.
Rate limiting & retry backoff
All outbound LLM API calls include exponential backoff and rate-limit protection, preventing runaway requests.
Minimal logging. Logs record technical events for troubleshooting. Access tokens, passwords, and payment data are never written to logs, and logs are not used for anything else.
Compliance & Standards
Regulations and policies we follow
Regulatory Compliance
GDPR
Right to access, correct, and delete your data. 30-day response guarantee.
CCPA
California Consumer Privacy Act. We do not sell your personal information.
Meta Platform Policy
Full compliance with Meta's Developer Policies, Platform Terms, and API usage rules.
PCI DSS (Paddle)
Card payments meet Payment Card Industry standards through Paddle. We never handle card data.
Data Minimisation
We collect only what is strictly necessary to run the service. Nothing more.
Auto-Deletion
DM data automatically purged after 7 days. No manual cleanup required.
Questions about your data?
Read the full Privacy Policy, Terms of Service, or contact our team directly at info@solarischat.com