Security and privacy

Security

How Texa protects your data and your customers: sign-in, isolation, encryption, what Texa AI may and may not do, and how to stop it.

Short answers for your security review. Ask [email protected] for the full security pack.

Multi-factor authentication (an authenticator app, with backup codes) for each person.
Single sign-on with Microsoft Entra ID, Google Workspace or any SAML 2.0 provider, only for your own proven domains, optionally enforced.
Texa's own staff always sign in in two steps.
Sign-in attempts and password resets are rate-limited.
Roles: administrators, agents, and custom roles with only the permissions you give. People see only their own inboxes and teams.

Your keys

Texa API keys are shown once; only a hash is kept. Revoke one and it stops at once.
Widgets never hold a key: your server makes a short-lived session for one customer, valid only on the websites you list.
Everything Texa sends you is signed (HMAC-SHA256 with a timestamp). How to check

Isolation and encryption

Every company's data is kept apart by row-level security in the database, tested on every table.
Every secret Texa keeps for you (your API keys for connectors, webhook secrets, helpdesk keys) is sealed with AES-256-GCM, under keys outside the database, and never written to a log.
TLS for everything in transit; connectors call only https in live.

What Texa AI may do

Only actions you connected, only in a step of a procedure a named person approved.
Changes need the customer's yes, and verification first where the action says so.
Private fields (an amount, an account number) are never said to an unverified customer.
Failures are told as failures: Texa AI never claims an action succeeded when it didn't.
Connectors never reach a private address (no server-side request forgery), and follow no redirects.
Card numbers, PINs, passwords, CVVs and verification codes are masked before any AI model reads them.

Stopping it

Switch Texa AI off at once: for the whole account (Texa AI → Safety), for one inbox, one helpdesk connection, one Relay or one key. Conversations go to your team.

Audit

Settings → Audit logs records sign-ins, settings changes, SSO, and every view of a sensitive ticket; Texa AI's settings changes are recorded with who made them. Every action call is recorded with its result, with sensitive values hidden.

Privacy

Texa follows the Nigeria Data Protection Act 2023. You can export a conversation, and forget a customer on request. The services Texa uses and what each receives are in the privacy notice. When a company closes its account, its data is deleted: closing an account.

Reporting a vulnerability

Write to [email protected] with what you found and how to reproduce it. Please don't test against other companies' accounts or real customers.