Skip to content
NewTalk to Basher from your browser — free

Security & trust

Claims a fact-checker can sit with.

Your customers' data is isolated and encrypted — and the rest of this page proves it in an auditor's language: what is enforced in code today, and what is on the roadmap, clearly separated. We would rather earn trust slowly than borrow it.

Enforced today

  • TENANCY-GATE

    Tenant isolation, gated

    Every table, queue and data surface is tenant-scoped, verified by an automated tenancy gate that fails our test suite on any unscoped surface.

  • KMS-ENVELOPE

    Envelope-encrypted secrets

    Tenant credentials are envelope-encrypted with cloud KMS; plaintext secrets never sit in the database.

  • PIPELINE-GUARD

    Topic guardrails

    Allowed and blocked topics are compiled into each agent with turn budgets. On our own call engine they are enforced in the pipeline, not requested in a prompt: every caller turn is checked before the model sees it, and the opening sentence of every reply is checked before it is spoken. On the hosted demo runtime they are written into the agent's instructions, and we say so.

  • HMAC-VERIFY

    Authenticated integrations

    Inbound webhooks are signature-verified with replay protection, and internal service calls authenticate with rotating secrets and fail closed. Tools called by the hosted runtime carry a per-organisation credential instead — bound to that organisation, without per-request replay protection, because that runtime can only send static headers.

  • RLS-POLICY

    Row-level security

    Database access is governed by row-level security policies alongside the application-layer gates.

On the roadmap — said plainly

Planned

In-Kingdom processing

Full in-Kingdom voice processing is our stated direction, with region gates already built into the deployment. Until it is live end to end, we won't claim it.

Planned

Formal certifications

SOC 2 and related audits are planned as we scale with founding partners. Ask us where we are — we'll tell you exactly.

PDPL alignment

Consent capture, purpose limitation and data-subject rights are designed into the platform. Read our PDPL statement for specifics.

PDPL statement

Put the claims to your own ear.

What you read above is written in the code, not in a slide deck. Talk to the live agent — and if your auditor wants the detail, we're ready for it.

Talk to Basher liveBook a walkthrough