Security is engineered in, not bolted on.
A straightforward account of how OGAMI protects your business data, your customers’ conversations, and your account access.
Encryption in transit
Every connection to OGAMI, including the website, the client portal, and every API call in between, runs over TLS. Nothing moves between your browser and our servers unencrypted.
Secrets management
API keys and service credentials are stored as encrypted environment variables in our hosting and database providers, never in source code, and are scoped to the minimum access each service needs.
Database-level access isolation
Customer data is protected with row-level security at the database layer, and client portal accounts are scoped so one business can never read another business's leads, conversations, or profile data.
Authenticated, session-scoped access
The admin console and client portal both require authentication, with session cookies marked HttpOnly and Secure so they can't be read by page scripts or intercepted over an unencrypted connection.
Verified webhook signatures
Inbound WhatsApp events are cryptographically verified against Meta's signing secret before they're trusted, so only genuine messages from Meta's platform reach OgaChat.
Rate-limited AI endpoints
Every AI-powered conversation endpoint is rate-limited to absorb normal customer traffic while blocking scripted abuse.
Human oversight, always
OgaChat never operates without a way for a human to intervene. Every account gives the business owner or operator the ability to review any conversation and take over from the AI at any time. AI replies are logged and auditable, not a black box.
Where we’re headed
OGAMI is a young platform, and we’re building our formal security and compliance program deliberately as we scale, including working toward recognized standards such as SOC 2, ISO 27001, and alignment with data protection frameworks including the NDPA and GDPR. We’ll publish progress here as it becomes real, rather than claim it before it is.
Reporting a vulnerability
If you believe you’ve found a security issue in OGAMI, please tell us before telling anyone else: hello@ogamy.co. We take every report seriously and will respond directly. See also our security.txt.
