Compliance & HIPAA

Current Compliance Status

ChatBotPro maintains enterprise-grade security and compliance practices. While we are not currently HIPAA-certified (we do not sign BAAs by default), our infrastructure is built to support HIPAA-level controls.

For customers requiring HIPAA compliance, we offer a dedicated Enterprise plan with BAA execution, dedicated infrastructure, audit logging, and enhanced access controls. Contact our sales team to learn more.

Encryption & Data Security

All data transmitted between your visitors and our platform is protected by TLS 1.3 encryption (in transit). Data at rest is encrypted using AES-256 across our database and storage layers.

Our infrastructure runs on AWS and Supabase, both SOC 2 compliant, providing industry-standard physical and network security controls.

• Encryption in transit: TLS 1.3
• Encryption at rest: AES-256
• Database: Encrypted volumes with automated backups
• Access: Role-based with strict least-privilege policies
• Monitoring: 24/7 intrusion detection and logging

Business Associate Agreement (BAA)

A Business Associate Agreement (BAA) is available for customers on our Enterprise plan. The BAA covers the required HIPAA provisions for the handling, storage, and transmission of Protected Health Information (PHI).

To request a BAA, please contact our compliance team at compliance@chatbotpro.ai with your account details and compliance requirements.

Data Handling & Storage

ChatBotPro processes and stores the following data types:

• Account Data: Name, email, billing info — stored securely and never shared
• Training Data: Content you upload (documents, URLs, Q&A) — used only for your chatbot
• Conversation Data: Chat logs between your visitors and your chatbot — retained for your subscription period + 30 days
• Lead Data: Visitor emails and info captured by lead capture — owned by you, never used for our purposes

We do not sellyour data or your visitors' data. We do not use customer content to train our base AI models.

Certifications & Frameworks

• SOC 2 (Type II) — Infrastructure providers (AWS, Supabase)
• GDPR — Data processing compliant for EU users
• CCPA — California Consumer Privacy Act compliance
• ISO 27001 — Information security management (via infrastructure partners)
• HIPAA — BAA available on Enterprise plan; infrastructure HIPAA-eligible

Report a Security Issue

We take security seriously. If you discover a vulnerability or have concerns about our security practices, please contact our security team immediately.

Email: security@chatbotpro.ai

We aim to acknowledge all security reports within 24 hours and resolve critical issues within 7 days.