How we secure the data behind every chat.

All connections to CogniChat are over TLS 1.2 or higher. Data at rest , your messages, customer records, order history, is stored encrypted at the database layer with provider-managed keys. Backups are encrypted too, with separate keys.

Card details are handled entirely by Paystack, a PCI-DSS Level 1 certified payment processor. We never see, store, or transmit unencrypted card numbers. For Mobile Money, we hand off to Paystack for the same reason.

When a chat reaches our AI layer, the message content is forwarded to Google's Gemini API. The provider does not retain those messages for model training under our enterprise terms. We log enough metadata to debug failures, typically token counts, latency, and an identifier, but not the message bodies beyond a short rolling window.

Team members get role-based access within a workspace (owner, admin, member). On our side, only a small number of engineers can reach production data, and only when they need to debug a customer report, after a request is logged. We rotate credentials regularly and use single sign-on for our internal tools.

If we detect a security incident that affects your data, we notify the workspace owner within 72 hours, with what we know, what we're doing, and what (if anything) you should do. We follow up with a post-incident write-up once root cause is confirmed.

If you've found something, we'd like to hear about it before anyone else does. Email support@vendyi.com with reproduction steps. We respond within two business days, fix confirmed issues quickly, and credit reporters publicly with permission.

THIS DOCUMENT IS A WORKING DRAFT. THIRD-PARTY SECURITY AUDIT IS PLANNED.