Essential cookies keep you signed in; analytics only with your consent. See our Privacy Policy

Security at Monqez AI

We treat your data the way we'd want ours treated

Multi-tenant isolation. Encryption at rest. Bcrypt-hashed passwords. TLS 1.2+ with HSTS. Strict CSP. HMAC-signed unsubscribe. Every claim on this page is grounded in the production code — not aspirational marketing

AES-256-GCM at rest bcrypt-12 passwords TLS 1.2+ HSTS CSP grade A GDPR-aware
Tenant isolation

Your data lives in its own room

Every customer signed up to Monqez AI gets a logically isolated slice of the system. Concretely:

  • Database isolation: every row in every table is scoped by user_id. Backend queries always include this filter — there is no path in the API that returns another tenant's data
  • Knowledge-base isolation: the AI brain that powers your departments is trained only on your products, your policies, and your conversations. It cannot see — and is not trained on — any other customer's data
  • Integration isolation: the credentials you connect (your WhatsApp Business, your SMTP, your CRM) live encrypted in your row only. They are never shared, indexed, or used to power anyone else's workflows
  • No shared-model training: your conversations are never used to train a shared model that other customers benefit from. Your data is yours
Encryption

Encrypted at rest, encrypted in transit

  • At rest: sensitive fields (integration tokens, SMTP credentials, API keys) are encrypted with AES-256-GCM, an authenticated cipher that detects tampering. The encryption key is held in a server-side environment variable, never in code, never in version control
  • In transit: every request to monqezai.io is served over TLS 1.2+ with HSTS enforced for one year, which means browsers refuse to downgrade to HTTP
  • Database backups: taken automatically, encrypted, and kept on rotating storage. Backups are tested periodically to confirm they restore
Authentication

Passwords are never stored. Sessions are short

  • Passwords are hashed with bcrypt at cost factor 12. Plain-text passwords are never logged, never stored, never sent
  • Password resets use a one-time token sent by email — the actual password is never included in any communication
  • JWT sessions are short-lived (7 days for customers, 12 hours for admins, 30 minutes for impersonation). Tokens are signed with a server-side secret and never persisted in the browser beyond an HttpOnly cookie / secure storage
  • Admin access is segregated from the customer app — different routes, different auth tier, different audit trail
Network & headers

Hardened browser surface

We score grade A on securityheaders.com thanks to:

  • HSTS for 1 year with includeSubDomains
  • Strict Content-Security-Policy limiting script and style sources to a tight allowlist
  • X-Frame-Options: DENY + CSP frame-ancestors 'none' to block clickjacking
  • X-Content-Type-Options: nosniff + Referrer-Policy: strict-origin-when-cross-origin
  • Permissions-Policy disables every browser API we don't actively use (camera, mic, geolocation, payment, USB, FLoC, etc.)
  • Cross-Origin-Opener-Policy places our pages in their own browsing-context group — mitigating Spectre-style cross-window (XS-Leak) probing by other sites
Compliance

Email compliance is built in, not bolted on

  • HMAC-signed unsubscribe: every Sales email carries a tamper-proof unsubscribe link. The token verifies the recipient + campaign on click; no per-link database row needed
  • Opt-out enforcement: unsubscribed addresses are stored per-tenant and checked before every future send. Pending and approved drafts to opted-out addresses are auto-skipped
  • SPF / DKIM / DMARC helpers: the dashboard walks customers through configuring their own sending domain for optimal deliverability. We send from your mailbox, not ours — which means you control your sender reputation
  • GDPR-aware: you can export your data and delete your account yourself from Settings → Account (or on request). Right to be forgotten is honoured
Payments

We never see your card

  • Your card never reaches our servers. Plan purchases run through Stripe Checkout — you complete payment on a page hosted by Stripe. When you save a card in the dashboard, the input fields are rendered by Stripe inside their own iframe and the details go straight from your browser to Stripe. Monqez is not in the path either way
  • We store a reference, not a card. All we keep is a Stripe token plus the last four digits, the brand and the expiry date — enough to show you "Visa ending 4242" and nothing more. The full card number is never stored, and the CVV is never stored or transmitted by us at all
  • Stripe is PCI DSS Level 1 certified — the highest level defined by the standard, audited annually. Card data lives with them, under that certification, not with us
  • Payment confirmations are cryptographically verified. Stripe signs every event it sends us and we check that signature before acting on it. An unsigned or tampered message is rejected outright — so nobody can forge a "payment succeeded" message to unlock a paid plan
  • You cannot be charged or provisioned twice.Every payment event is claimed atomically before it is processed. If Stripe retries a delivery, the duplicate is recognised and discarded
  • Cancel it yourself. Monthly plans cancel in one click from the dashboard, and removing a saved card deletes it at Stripe as well as here
Responsible disclosure

Found something? Tell us — we'll listen

We take security reports seriously and respond within 48 hours. Our disclosure policy lives at /.well-known/security.txt (RFC 9116) — please read it before testing

Please don't run automated scanners against production without prior coordination — they create false-positive noise and can trip our rate limits. Email us first and we'll set up a window
Report a security issue View security.txt
FAQ

Security questions, answered straight

Is my customer data isolated from other Monqez AI customers?

Yes. Every customer has their own database row, their own knowledge base, and their own integration credentials. Queries are scoped by user_id on every read and write. We never share data across tenants and never train shared models on customer conversations

How is data encrypted?

Sensitive fields (integration tokens, SMTP credentials, API keys) are encrypted at rest with AES-256-GCM using a key held in a server-side environment variable — never in our code or version control. All traffic to and from monqezai.io uses TLS 1.2+ with HSTS enforced for one year

How are passwords stored?

Passwords are hashed with bcrypt at cost factor 12. Plain-text passwords are never logged, never stored, and never sent in emails — including password resets, which use a one-time token instead

Do you store my credit card details?

No. Card details never reach our servers. Plan purchases run through Stripe Checkout, where you pay on a page hosted by Stripe, and when you save a card in the dashboard the input fields are rendered by Stripe inside their own iframe — the details go straight from your browser to Stripe. We store only a Stripe token plus the last four digits, the card brand and the expiry date, which is what lets the dashboard show you "Visa ending 4242". The full card number is never stored, and the security code (CVV) is never stored or transmitted by us at all. Stripe is certified PCI DSS Level 1, the highest level the standard defines, and every payment confirmation Stripe sends us is signature-verified before we act on it

What email-compliance tools are built in?

Every outbound Sales email carries an HMAC-signed unsubscribe link, and opt-outs are enforced before any future send — including across campaigns — which helps you meet requirements like CAN-SPAM. You send from your own mailbox and stay the data controller for your outreach, so compliance with the laws that apply to you (e.g. GDPR and local marketing rules) remains your responsibility — we provide the tools, not a legal guarantee

Where is data hosted?

On a dedicated VPS in the EU (Frankfurt region). Backups are encrypted. We use self-hosted infrastructure — your data is not on a hyperscale cloud unless you explicitly connect one via an integration

How do I report a security issue?

Email support@monqezai.io or fetch https://monqezai.io/.well-known/security.txt for our disclosure policy. We respond within 48 hours

Trust starts with transparency

Any other questions about how we handle your data? Email us and we’ll answer

Email usSee pricing