Security and data protection

Encryption, in transit and at rest

Every connection to SIMCOAI — the dashboard, the API, phone calls and every public page — runs over TLS 1.2 or 1.3 with HTTP Strict Transport Security enforced, so nothing between your browser and SIMCOAI travels unencrypted. Passwords are never stored on SIMCOAI‑controlled systems at all: sign‑in is handled entirely by the hosted login service, which SIMCOAI itself cannot read.

The credentials SIMCOAI's own systems use to reach its payment, calling, messaging and AI providers, and every secret SIMCOAI holds on your behalf — webhook signing secrets and any AI provider key you connect — are encrypted at rest with ChaCha20‑Poly1305, decrypted only in memory when needed, and never stored as plain text on disk. Each secret is individually bound to your account, so a copy of one record cannot be read against another. ChaCha20‑Poly1305 is a public, peer‑reviewed IETF standard (RFC 8439) rather than an algorithm of our own devising, and is used at scale by Google, Apple and Cloudflare in their own production systems.

• TLS 1.2/1.3 enforced on every public and API host, with HSTS
• No password is ever stored in SIMCOAI's own database, for any account
• 256‑bit keys throughout — the same key size used for the most sensitive traffic at the companies named above
• Every ciphertext carries an authentication tag: if a stored secret is altered by even one bit, decryption is refused outright rather than returning a tampered value
• ChaCha20 performs no data‑dependent table lookups, so it is naturally resistant to the cache‑timing side channels that have affected some software AES implementations, with no special hardware required
• A published, independently‑reviewed standard rather than private code — one of the things an assessor checks for under UK GDPR Article 32 and SOC 2, though strong encryption alone is not a substitute for the rest of a compliance programme

Protect dashboard access

Use strong passwords, OAuth from trusted providers, authenticator app MFA where available, and role-based access for team members.

• Remove users who no longer work for the business
• Use business email accounts where possible
• Do not share one login across a team
• Review billing and account changes regularly

Handle customer information carefully

SIMCOAI should only receive data needed to answer, route or log the customer task. Sensitive information, especially card numbers, should not be requested or stored in AI chat or voice logs.

Ways you and your team sign in

Sign‑in runs through a hosted login page rather than a form embedded in the dashboard. You are sent to it from the SIMCOAI login screen, you sign in there, and you are returned to your dashboard. Your password is never typed into a SIMCOAI page, and SIMCOAI never stores it.

These methods are available depending on what is enabled for your account:

• Password with a secure reset link.
• Passkeys and passwordless sign‑in (Windows Hello, Touch/Face ID, 1Password, iCloud Keychain, Android) — nothing to phish.
• Google and Microsoft accounts, where those connections are enabled for your account.
• Email sign‑in link & 6‑digit code — one email gives both.
• Multi‑factor authentication with an authenticator app, and Remember me for trusted browsers.
• Verified email — an address has to be confirmed before it can reach account data.

Signing out ends your SIMCOAI session and the hosted login session, so the next sign‑in starts fresh rather than silently reusing the last identity.

API keys and webhook secrets

Create scoped API keys for server‑to‑server work; the secret is shown once, so store it safely and rotate it when staff or suppliers change. Webhook signing secrets are also shown once. Never handle secret keys or signing secrets from a browser.

Legal acceptance gates

The dashboard can block feature access until required policy versions are accepted. This keeps business-use confirmation, privacy, cookies, AI, billing and telecoms terms tied to backend records.