Exact promises, in writing
What Botsplash does for security, access, data handling and consent, stated as narrowly as the evidence allows, and the packet your security and legal teams can review.
For Botsplash Customer Engagement. Report, period and scope available under NDA.
How the service is protected
Botsplash Customer Engagement has completed a SOC 2 Type II examination. The report, its period and its scope are available under NDA through the security packet.
Data is encrypted in transit and at rest. Insecure traffic is upgraded to TLS; sensitive fields can be masked in the interface.
The service runs on Amazon Web Services with account-level lockdowns and a web application firewall. Ask about hosting options for enterprise requirements.
Production access is limited to named Botsplash staff and reviewed. Customer data is never used for demos or marketing.
Who can see what
Google Workspace, Microsoft 365, Active Directory Federation Services and Salesforce, with other identity providers by arrangement.
Role-based permissions in both products; separate workspaces with tenant isolation in Botsplash CRM for business units.
Custom domains, IP and domain restrictions, and client-side controls you set for your own users.
Every action in Botsplash CRM, human or AI, is on the activity record. Access and permission events are a report.
Retention, export and the people who process it
Retention follows the policy you set for your account; purge on termination runs on the schedule agreed in writing.
Contacts, Leads, Applications, conversations and the activity record can be exported at any time.
The current list of subprocessors and regions is part of the security packet and is updated when it changes.
A documented process with customer notification under the terms of your agreement.
The boundaries
A trust center is also a list of the things a vendor should not say. These are ours.
- No software setting makes a business compliant. Consent, opt-out, quiet-hour and suppression tools apply the rules your compliance team sets, and the record shows what happened.
- AI in Botsplash CRM proposes and drafts; a person approves. It does not decide eligibility, pricing or underwriting.
- Your LOS, POS and AMS stay the systems of record. Botsplash does not replace them, and it does not replace your mailbox.
- Results on this site from Customer Engagement customers are theirs, measured against their baselines. They are not a promise about yours.
Questions security and legal teams ask
Can we see the SOC 2 report?
Yes, under NDA. Request the security packet and we send the report, its period and scope, the subprocessor list and our security questionnaire answers.
Does the SOC 2 examination cover Botsplash CRM?
The completed examination covers Botsplash Customer Engagement. We state scope exactly as the report does; ask us for the current status of the CRM’s inclusion rather than assuming it.
Where is our data processed?
On Amazon Web Services. The regions and the subprocessors are listed in the security packet so your legal team can review the exact arrangement.
Do you support 10DLC and consent capture?
Yes. Botsplash supports 10DLC brand and campaign registration, captures consent and opt-outs per channel with their source and timestamp, and honors STOP across channels. Your compliance team decides the rules those tools enforce.
How do we run a security review?
Request the packet, send your questionnaire, and name a security contact. We answer in writing, and a technical call is available for your architecture questions.