Last updated: July 2026 · Beta program
Happli holds business data on behalf of working businesses, and we treat that as the core responsibility of the product. Here's how the Service is protected today — stated plainly, without badges we haven't earned yet.
Every business's data is separated at the database layer using row-level security — isolation is enforced by the database itself on every query, not just by application code. The application connects with least-privilege database roles: the app role cannot read across tenants and cannot delete records in append-only tables like the audit log.
Data is encrypted in transit (TLS) and at rest (our database provider encrypts storage). Payment details are handled entirely by Stripe — full card numbers never touch our systems.
No client-facing message leaves the Service without the business operator's explicit approval. This is a permanent architectural decision, not a setting — it means an AI mistake can't reach your clients on its own, and every outbound message has a human decision attached to it in the audit trail.
Actions in the Service — syncs, drafts, approvals, sends, opt-outs — are recorded in an append-only audit log scoped to your business.
Sign-in uses secure, expiring email links — there are no passwords to steal or reuse. Sessions are cookie-based and can be ended by signing out.
AI drafting runs through Anthropic's API under commercial terms: content sent for drafting is not used to train models. The public website chat widget answers only from a business's public-appropriate information (services, prices the business has confirmed, hours, profile) — it has no access to client records, metrics, or internal data.
Opt-outs (STOP, unsubscribe) are honored immediately and permanently per channel. Quiet hours are enforced for text messages. Outbound links in messages are validated before send.
We're a beta-stage product. We don't yet hold formal certifications (such as SOC 2), and we don't yet offer HIPAA business associate agreements — those are on our roadmap as the Service matures. If your compliance needs are ahead of where we are, tell us; it directly shapes what we build next.
If you believe you've found a security issue, email hello@gohappli.com with details. We'll acknowledge within 2 business days, and we ask that you give us a reasonable window to fix the issue before public disclosure. We're grateful to people who report responsibly.