Secure and compliant by design
The protections that keep your data, your team, and your customers safe. Built into every plan.
Encrypted In Transit & At Rest
Every connection is secured with TLS 1.2+ (HTTPS), and all customer data, uploaded documents, and form submissions are encrypted at rest with AES-256. Your data is protected the moment it leaves your site and for as long as we hold it.
GDPR Compliant
We process personal data under a clear Data Processing Addendum, honor right-to-erasure requests, and give you full control over how submission data is stored and deleted.
You Own Your Data
Your submissions, contacts, and documents are yours. Export or permanently delete any record on demand. We never sell your data.
Role-Based Access
Invite your team and assign roles. Give each member exactly the permissions they need, and see who handled which lead with activity logs.
Rate Limiting & Spam Protection
Submission endpoints and chatbots are protected against abuse with request rate limiting and built-in spam filtering, so bad actors can't flood your inbox.
Domain Controls
Restrict which domains your forms and chatbot widgets can be embedded on, so your endpoints only accept traffic from sites you approve.
Secure Payments
Billing runs through Razorpay, a PCI-DSS compliant processor. Card details are handled directly by Razorpay. We never see or store full card numbers.
Your Data Stays Yours With AI
We call model-provider APIs to generate chatbot replies and auto-responses. Your content is never enrolled in any provider's model-training program.
Transparent about your data
You should always know where your data lives, who can touch it, and how to remove it.
Transparent Processing
Our Data Processing Addendum and public subprocessor list spell out exactly who touches your data and why. No hidden third parties.
Trusted Infrastructure
Inletbase runs on Amazon Web Services with Google Firebase for the database, authentication, and file storage. Both are hardened, enterprise-grade platforms.
Deletion On Demand
Need a record gone? Delete individual submissions, contacts, or your entire account at any time to satisfy right-to-be-forgotten requests.
See the full list of providers we work with on our Subprocessors page.
Operational security
Security isn't just a feature list. Here's how we run the platform behind the scenes to keep it available, resilient, and protected.
- AES-256 encryption at rest and TLS 1.2+ in transit across all services
- Automated, encrypted backups with point-in-time recovery
- 24/7 uptime monitoring with a public status page
- DDoS protection and network firewalls at the infrastructure layer
- Least-privilege internal access, gated by role and fully audit-logged
- Two-factor authentication on all internal administrative tooling
- Two-factor authentication (2FA) available on your Inletbase account
- Continuous security patching of servers and dependencies
- Data processed in US regions on AWS and Google Cloud
Track real-time availability on our status page.
Security & Privacy FAQ
Straight answers about how Inletbase protects your data.
Yes. We offer a Data Processing Addendum, maintain a public list of subprocessors, load analytics only after explicit consent, and let you permanently delete any personal data on demand to support right-to-erasure requests.
Yes. All data is encrypted in transit using TLS 1.2+ (HTTPS) and encrypted at rest with AES-256, the same industry-standard algorithms used across our AWS and Google Cloud infrastructure.
Yes. Your data is backed up automatically on an encrypted, recurring schedule with point-in-time recovery, so we can restore it in the event of an incident.
Yes. Two-factor authentication (2FA) is available on your Inletbase account for an extra layer of login security. Internally, 2FA is also enforced on our administrative tooling, and staff access is least-privilege and audit-logged.
No. We use your uploaded documents and website content only to build and run your own chatbot and auto-replies. We never use your data to train our own or anyone else's general-purpose AI models.
No. We generate responses by calling model-provider APIs through our inference layer and do not opt in to any data-sharing or training program. Your content is used to produce a response and is not used to train their models.
By default, only you and the team members you invite can access your workspace. A chatbot or form is only reachable publicly once you deploy or embed it yourself. You control roles, permissions, and which domains can embed your endpoints.
Our application and services are hosted on Amazon Web Services. Google Firebase provides our primary database (Firestore), user authentication, and file storage. Both are enterprise-grade providers with strong physical and network security, and your data is processed in US regions.
We rely on a small set of trusted providers for hosting, AI inference, payments, and opt-in analytics. The full, current list, including each provider's purpose and processing location, is published on our Subprocessors page.
We follow SOC 2-aligned security practices across access control, encryption, and vendor management. We are not yet formally SOC 2 certified. It's on our roadmap as we grow. In the meantime, our DPA, subprocessor transparency, and GDPR practices give you a clear picture of how we protect your data.
We welcome responsible disclosure. If you believe you've found a security issue, email us at hello@inletbase.com with the details and steps to reproduce. We'll acknowledge your report and work with you to resolve it quickly.