Encrypted in transit
Every page, message and API call travels over HTTPS (TLS). HSTS keeps browsers from ever falling back to plain HTTP.
Security at Ekam
Your conversations stay yours.
Ekam sits between you and your customers, so security isn't a feature we bolted on. Here is exactly how we protect your messages, your accounts and your keys.
- HTTPS / TLS encrypted
- AES-encrypted keys
- No passwords stored
- We don't sell or read your data for ads
Step by step
How a message reaches you
Every hop is encrypted. The keys to your accounts are locked away even inside our own database.
- Your customer writes on WhatsApp, Gmail, Slack, Teams…
- Ekam Isolated workspace · AES-encrypted keys
- Only your team sees it Signed in, role-checked, logged
Security at a glance
Keys locked with AES
Access tokens and API keys are encrypted with Fernet (AES-128 + HMAC-SHA256) before they touch the database.
Official sign-in, no passwords
Google, Microsoft, Slack and Meta connect through OAuth. We never see or store your account passwords.
Isolated per workspace
Every company's data, connections and AI memory are walled off. Webhooks are verified with per-workspace secrets.
Never used to train AI
Messages sent for AI drafting go through OpenAI's business API, which doesn't use API data to train its models.
You approve what's sent
AI drafts; you decide. Replies only go out automatically on channels where you've switched on an auto-reply rule.
The details
Encryption
- In transit: all traffic between your browser, Ekam and the platforms we connect to uses HTTPS (TLS). HTTP requests are redirected, and HSTS tells browsers to only ever use the secure connection.
- Secrets at rest: OAuth access tokens, refresh tokens and API keys are encrypted with Fernet — AES-128 in CBC mode with an HMAC-SHA256 signature — so a stolen database copy doesn't hand over your accounts.
- Passwords: your Ekam password is stored only as a salted, slow hash (PBKDF2). Nobody — including us — can read it.
Access control
- Workspace isolation: every query is scoped to your company. One workspace can never see another's messages, contacts or AI memory.
- Roles: owners, admins and members get different permissions, and the activity log records who did what.
- Official OAuth: Gmail, Outlook, Teams, Slack and Meta are connected through each provider's own sign-in screen, with only the permissions Ekam needs. Revoke access from Ekam or from the provider at any time.
Application security
- CSRF protection on every form, secure and HTTP-only session cookies, clickjacking and MIME-sniffing protection headers.
- Incoming webhooks are verified with a per-workspace secret compared in constant time.
- Rate limits on public forms and API endpoints to slow down abuse.
- Tokens and secrets are never written to logs or error messages.
AI & your data
- AI never sends a message on its own unless you've switched on an auto-reply rule for that channel.
- Message text needed for a draft is sent to OpenAI's API. Under OpenAI's API terms, that data isn't used to train their models.
- We don't sell your data, and we don't use it for advertising.
You stay in control
- Disconnect a channel and the data we indexed from it is deleted.
- Delete your workspace and everything goes with it.
- Found a vulnerability, or have a security questionnaire? Email security@ekam.io.
Report a vulnerability or ask a security question: security@ekam.io. See also our privacy policy.
Secure by default. Simple by design.
Start a free trial — connect your first channel with official sign-in in two minutes.
- 1-day free trial
- Set up in 2 minutes
- Cancel any time