Tephlo is multi-tenant, handles real customer conversations, and holds the credentials to your messaging channels. This page states what protects each of those, and where the defaults deliberately favour caution over convenience.
Every workspace’s data is scoped and separated. Requests are resolved to a workspace on the server from the authenticated session — the browser never supplies a workspace identifier, so there is no identifier for a client to tamper with.
Isolation is proved rather than assumed. The retrieval evaluation runs against a decoy workspace holding the same products at different prices, so a leak surfaces as a wrong price — the failure that would actually reach a customer — instead of as an obviously foreign document nobody would notice. Surfacing another workspace’s material, or another conversation’s carried state, is a hard failure in the quality rubric that no other score can offset.
Credentials and secrets
Channel secrets are encrypted at restWhatsApp tokens and Telegram bot tokens are stored encrypted and are only ever shown back to you masked in the console.
A channel cannot go live unverifiedFor WhatsApp that means completing the webhook handshake with Meta — answering the challenge and validating the request signature — before the channel can be enabled. A channel that later fails verification is disabled rather than left half-working.
The web widget is origin-lockedOnly the exact origins you list may embed the chat frame, and the widget cannot be enabled until at least one is set. The embed key can be regenerated at any time, which invalidates the old one immediately.
Uploaded documents fail closedWhere document processing is enabled, a document is not parsed unless a malware scan returned clean. Raw uploads are deleted immediately after text extraction by default.
Accounts and access
Roles are enforced by the backend, not by hiding buttons. An agent who navigates directly to an admin screen is refused by the API, not merely redirected. See who sees what.
Multi-factor authentication is enforced for platform operators, and available to everyone in your workspace from Account & security — along with a Telegram recovery option and a single control that revokes every active session you hold anywhere.
Who can start a conversation with you is your decision too. A public workspace is listed and reachable by anyone; an unlisted one is reachable only with your exact routing tag; a private one is closed, and customers must redeem a one-time membership invite before they can write at all. Private workspaces also have their public share links suppressed automatically.
Audit trails
Changes that matter are recorded with who made them, when, and why.
Channel history — every credential and configuration change on a channel, including the reason given when one is disconnected, readable from the channel row itself.
Privacy request audit — every export and deletion your workspace performs.
The privacy audit deliberately holds salted one-way hashes and aggregate counts only — never a raw customer identifier and never transcript content. An audit log that quietly accumulated the personal data it was auditing would be a second copy of the problem.
What it refuses to collect
Some information should never be typed into a chat, and the assistant will not ask for it whatever it is configured to do.
Card numbers, CVVs, PINs, passwords, one-time codes, bank and identity-document numbers are refused. The deny list is applied both when a plan for collecting details is built and when your own checklists are rendered into a reply, because a guarantee enforced at one of two doors is not a guarantee. Adding “card number” to a checklist on the conversation-goals screen does not make it collectable. Asking for, repeating or offering to store any of it is a hard failure in the quality rubric.
This is also why the assistant has no checkout: there is nowhere in this platform for a payment detail to go, so there is no reason to ever ask for one. See what it cannot do.
Privacy tooling
The console’s Privacy Center fulfils a verified customer access or deletion request for your workspace, without anyone needing database access.
ExportDownloads the matching transcript together with conversation, routing, session, escalation and membership metadata as JSON. It reports how many records matched, so “nothing found” is distinguishable from “something went wrong”.
DeletePermanently removes the matching data and any undelivered sends from your workspace. It cannot be undone, so the identifier must be typed a second time to confirm — a safeguard against deleting the wrong customer.
Reason, requiredBoth actions require a reason. Use a request or ticket reference; the field is not a place to paste message content.
Two things are your responsibility, and the console says so on the screen. Verify the requester before you act — confirm the organization and the affected messaging account. And handle the exported file carefully: it contains personal data and is not encrypted by your browser, so it belongs in whatever secure storage and sharing process you already use.
Consent and retention
Using real conversations to improve an assistant is genuinely useful and genuinely sensitive. The defaults here are set accordingly.
Silence is never consentPermission to use de-identified conversations for quality analysis defaults to off, and a workspace with no settings recorded at all is treated as having refused. You turn it on in Assistant → Performance → Reuse & memory, or you leave it off.
You set the retention windowImprovement data older than your retention setting is dropped, and an export carries an expiry that later steps refuse to look past.
There is no bulk sampling, by designNo “export the last hundred”, no “export everything escalated”, no schedule and no automation hook. Conversations are named one at a time, and a person must approve each one by hand before it can be used. Automatic selection is how a review corpus quietly becomes a copy of production.
Redaction is layered — and states what it cannot doEmails, phone numbers, long account and card numbers, labelled one-time codes and credentials, street-style addresses, API keys and tokens are removed automatically. Personal names, nicknames, relationships and anything identifying by combination are not — that is stated plainly rather than glossed, because a redaction report claiming completeness invites a reviewer to skim, and skimming is how a name ships.
Deletion is honoured downstreamAn export reads live data rather than a backup, so a conversation deleted since is simply absent, and each entry keeps a reference back to its source conversation so a later deletion request can find it.
Legal documents
The binding commitments live with the legal documents rather than in this guide.