Security and data protection

Encryption, in transit and at rest

Every connection to SIMCOAI — the dashboard, the API, phone calls and every public page — runs over TLS 1.2 or 1.3 with HTTP Strict Transport Security enforced, so nothing between your browser and SIMCOAI travels unencrypted. Passwords are never stored on SIMCOAI‑controlled systems at all: sign‑in is handled entirely by the hosted login service, which SIMCOAI itself cannot read.

The credentials SIMCOAI's own systems use to reach its payment, calling, messaging and AI providers, and every secret SIMCOAI holds on your behalf — webhook signing secrets and any AI provider key you connect — are encrypted at rest with ChaCha20‑Poly1305, decrypted only in memory when needed, and never stored as plain text on disk. Each secret is individually bound to your account, so a copy of one record cannot be read against another. ChaCha20‑Poly1305 is a public, peer‑reviewed IETF standard (RFC 8439) rather than an algorithm of our own devising, and is used at scale by Google, Apple and Cloudflare in their own production systems.

• TLS 1.2/1.3 enforced on every public and API host, with HSTS
• No password is ever stored in SIMCOAI's own database, for any account
• 256‑bit keys throughout — the same key size used for the most sensitive traffic at the companies named above
• Every ciphertext carries an authentication tag: if a stored secret is altered by even one bit, decryption is refused outright rather than returning a tampered value
• ChaCha20 performs no data‑dependent table lookups, so it is naturally resistant to the cache‑timing side channels that have affected some software AES implementations, with no special hardware required
• A published, independently‑reviewed standard rather than private code — one of the things an assessor checks for under UK GDPR Article 32 and SOC 2, though strong encryption alone is not a substitute for the rest of a compliance programme

Hourly encrypted local backups

SIMCOAI backs up core workspace data, sign-in records and stored files every hour. Backup copies are encrypted before storage and retained for about 30 days. They are currently local to the same hosting environment, so a loss of that environment could also affect the backups. Separate-site backups are planned.

If a settings save starts while a backup is running, the dashboard keeps showing its saving indicator and the change is applied after the backup finishes. For deletion and restore details, read the Privacy Policy.

Protect dashboard access

Use strong passwords, OAuth from trusted providers, authenticator app MFA where available, and role-based access for team members.

• Remove users who no longer work for the business
• Use business email accounts where possible
• Do not share one login across a team
• Review billing and account changes regularly

Handle customer information carefully

SIMCOAI should only receive data needed to answer, route or log the customer task. Sensitive information, especially card numbers, should not be requested or stored in AI chat or voice logs.

Ways you and your team sign in

Sign‑in runs through a hosted login page rather than a form embedded in the dashboard. You are sent to it from the SIMCOAI login screen, you sign in there, and you are returned to your dashboard. Your password is never typed into a SIMCOAI page, and SIMCOAI never stores it. A brief automated human-verification check runs on that page to keep out scripted sign‑in attempts — it is invisible for almost everyone and only asks for interaction if your browser looks automated.

These methods are available depending on what is enabled for your account:

• Password, created either at self‑service sign‑up or with a secure reset link.
• Passkeys (Windows Hello, Touch/Face ID, 1Password, iCloud Keychain, Android) — sign in with your device, nothing to phish.
• Google or GitHub account, where that connection is enabled for your account.
• Two‑step verification with an authenticator app or a security key, and Remember me for trusted browsers.
• Verified email — an address has to be confirmed before it can reach account data.

Signing out ends your SIMCOAI session and the hosted login session, so the next sign‑in starts fresh rather than silently reusing the last identity.

The Security page

Your account's own Security area is split into five parts: an overview, two‑step verification, connected accounts, sign‑in methods, and password. Reading any of them is unrestricted, but changing anything — turning two‑step verification on or off, removing a factor, or connecting or disconnecting an account — requires you to re‑confirm your identity first, even within an already signed‑in session. That re‑confirmation expires after a short window, so a browser left open on the Security page does not stay able to make changes indefinitely.

Connected accounts lists every sign‑in source linked to your account. You can hold more than one at a time (for example, both a password and a Google connection), and each keeps its own two‑step verification state — turning it on for one connection does not turn it on for another. Disconnecting your only remaining connection is refused, so you cannot accidentally lock yourself out. Connecting or disconnecting a source emails the account owner.

Removing your last enrolled two‑step method automatically turns two‑step verification back off, rather than leaving it switched on with nothing able to answer a challenge.

API keys and webhook secrets

Create scoped API keys for server‑to‑server work; the secret is shown once, so store it safely and rotate it when staff or suppliers change. Webhook signing secrets are also shown once. Never handle secret keys or signing secrets from a browser.

Legal acceptance gates

The dashboard can block feature access until required policy versions are accepted. This keeps business-use confirmation, privacy, cookies, AI, billing and telecoms terms tied to backend records.