[{"data":1,"prerenderedAt":148},["ShallowReactive",2],{"footer-legal":3,"legal-security":28},[4,7,10,13,16,19,22,25],{"path":5,"title":6},"\u002Flegal\u002Fprivacy","Privacy Policy",{"path":8,"title":9},"\u002Flegal\u002Fterms","Terms of Service",{"path":11,"title":12},"\u002Flegal\u002Fdata-deletion","Data Deletion",{"path":14,"title":15},"\u002Flegal\u002Fdpa","Data Processing Addendum",{"path":17,"title":18},"\u002Flegal\u002Fsubprocessors","Subprocessors",{"path":20,"title":21},"\u002Flegal\u002Fsecurity","Security",{"path":23,"title":24},"\u002Flegal\u002Fcookies","Cookie Policy",{"path":26,"title":27},"\u002Flegal\u002Facceptable-use","Acceptable Use Policy",{"id":29,"title":21,"body":30,"description":36,"effectiveOn":138,"extension":139,"meta":140,"navigation":141,"order":142,"path":20,"seo":143,"status":144,"stem":145,"summary":146,"__hash__":147},"legal\u002Flegal\u002Fsecurity.md",{"type":31,"value":32,"toc":125},"minimark",[33,37,42,45,48,52,55,58,62,69,72,76,79,83,86,90,96,100,103,107,110,114],[34,35,36],"p",{},"This page describes the measures we take to protect data in MapleChat. We describe what we\nactually do; where something is planned rather than in place, we say so.",[38,39,41],"h2",{"id":40},"tenant-isolation","Tenant isolation",[34,43,44],{},"MapleChat is multi-tenant: many businesses share the same infrastructure. Separation between\nthem is enforced in the database itself, not only in application code. Every tenant-scoped\ntable carries the owning company, and queries are filtered against the authenticated company on\nevery request. A query that omits the filter returns nothing rather than another tenant's rows.",[34,46,47],{},"This matters because application-level checks fail open when a developer forgets one. Enforcing\nisolation at the data layer means the default outcome of a mistake is no data, not the wrong\ndata.",[38,49,51],{"id":50},"authentication-and-access","Authentication and access",[34,53,54],{},"Team members authenticate through Firebase Authentication. Sessions are carried by\nshort-lived signed tokens that encode the user's company, role and team assignments; the server\nre-validates them on every request and never trusts a client-supplied company identifier.",[34,56,57],{},"Access within a workspace is governed by roles — Owner, Admin, Supervisor, Operator and\nViewer — which determine what each person can see and do. Permission decisions are made on the\nserver; hiding a control in the interface is never the only thing preventing an action.",[38,59,61],{"id":60},"encryption","Encryption",[34,63,64,65,68],{},"Traffic is encrypted in transit with TLS. The MapleChat domain is on the HSTS preload list at\nthe top-level-domain level, so browsers will not connect to it over plain HTTP under any\ncircumstance. TLS terminates at Cloudflare's network, which carries traffic on to our servers over\nan encrypted tunnel; Cloudflare is listed on the ",[66,67,18],"a",{"href":17}," page.",[34,70,71],{},"The credentials that connect your WhatsApp Business Account are encrypted by MapleChat before\nthey are written to the database, and the keys that decrypt them are kept separately from it.",[38,73,75],{"id":74},"credentials-and-secrets","Credentials and secrets",[34,77,78],{},"Access credentials for your WhatsApp Business Account, and all service secrets, are supplied\nthrough environment configuration and validated at start-up. They are not committed to source\ncontrol and are not written to application logs.",[38,80,82],{"id":81},"logging-and-monitoring","Logging and monitoring",[34,84,85],{},"We keep structured application logs and traces to operate and debug the service. Logs are\nwritten to exclude message content and authentication tokens. They are retained for a limited\noperational period and then discarded.",[38,87,89],{"id":88},"backups","Backups",[34,91,92,93,95],{},"The database is backed up on a regular schedule and backups are retained for a defined window.\nDeleted data is removed from backups within 30 days, as described in\n",[66,94,12],{"href":11},".",[38,97,99],{"id":98},"development-practices","Development practices",[34,101,102],{},"Changes are reviewed before release and covered by an automated test suite, including tests\nthat specifically assert tenant isolation holds. Dependencies are kept current.",[38,104,106],{"id":105},"what-we-do-not-yet-claim","What we do not yet claim",[34,108,109],{},"We hold no third-party security certification at this time — no SOC 2 report and no ISO 27001\ncertificate — and we have not completed an independent penetration test. We do not claim\ndisk-level encryption at rest across the infrastructure we run: the WhatsApp credentials\ndescribed above are encrypted by MapleChat itself, but the database and stored media otherwise\nrely on whatever the underlying hosting provides. We would rather say so plainly than imply\nassurance we do not have. This page will be updated when that changes.",[38,111,113],{"id":112},"reporting-a-vulnerability","Reporting a vulnerability",[34,115,116,117,124],{},"If you believe you have found a security problem, write to ",[118,119,120],"strong",{},[66,121,123],{"href":122},"mailto:security@maplechat.app","security@maplechat.app"," with\nenough detail to reproduce it. We will acknowledge within 5 business days and keep you updated.\nPlease give us a reasonable opportunity to fix the issue before disclosing it publicly. We will\nnot pursue legal action against researchers who act in good faith, avoid privacy violations and\ndo not degrade the service.",{"title":126,"searchDepth":127,"depth":127,"links":128},"",2,[129,130,131,132,133,134,135,136,137],{"id":40,"depth":127,"text":41},{"id":50,"depth":127,"text":51},{"id":60,"depth":127,"text":61},{"id":74,"depth":127,"text":75},{"id":81,"depth":127,"text":82},{"id":88,"depth":127,"text":89},{"id":98,"depth":127,"text":99},{"id":105,"depth":127,"text":106},{"id":112,"depth":127,"text":113},"2026-09-30","md",{},true,6,{"title":21,"description":36},"approved","legal\u002Fsecurity","The technical and organisational measures protecting data in MapleChat.","qVajtT0quN13MPgovfZ9ovSr1NATd5nrYTOEgOQ6ocY",1790867458143]