CanWeChat

Security

Built to receive untrusted messages safely.

We do not claim SOC 2, ISO, or other certifications we do not hold. The notes below match the current implementation. Related: Privacy, DPA, Subprocessors, Status.

Visitor isolation

Visitor tokens are hashed at rest. Raw tokens are not stored for later retrieval. Message HTML is stored and rendered as text, never as markup.

Domain locking

The public site key is meant to ship in your frontend. Allowed-domain locking restricts widget API use to hostnames you list. An empty list means unrestricted until you add domains — lock before production.

Integration secrets

Slack, Discord, and Telegram credentials are encrypted at rest with AES-GCM. The API never returns those secrets after creation. Server-side secrets live in Cloudflare Workers secrets, not client bundles.

Signed webhooks

Outbound events are signed with HMAC-SHA256 over timestamp and the raw JSON body. Failed deliveries retry from a queue; history records HTTP status and a bounded response snippet.

Workspace isolation

Every conversation query is scoped and authorized to its workspace. There is no cross-workspace list in the API.

Edge protection

Rate limits apply to public widget and dashboard APIs. Billing entitlement updates only from verified Dodo Payments webhooks — never from checkout redirects.

Vulnerability reporting

Email security@canwechat.dev with steps to reproduce, affected endpoints, and impact. Please avoid public disclosure until we confirm a fix or mitigation.

  • We aim to acknowledge valid reports within 3 business days.
  • We prioritize issues that expose other customers’ data or allow privilege escalation.
  • Please do not perform destructive testing against production workspaces you do not own.

Encryption, backups, incidents

  • TLS for data in transit on public endpoints.
  • Integration secrets encrypted at rest; visitor tokens hashed.
  • Primary data lives in Cloudflare D1; durability follows Cloudflare’s platform guarantees.
  • We notify affected workspace owners without undue delay after confirming a personal data breach involving their visitor content.

Outbound webhooks and SSRF

Webhook relay URLs must be HTTPS, must not include credentials, and must not target localhost, link-local, private IP literals (including octal/hex forms), or blocked metadata hosts. Delivery uses redirect: "manual" so we do not follow open redirects.

Residual risk: hostname checks do not resolve DNS before connect. A public-looking name could still resolve to a private address (DNS rebinding). Keep privileged internal services off the same network path as customer webhook egress, and prefer Cloudflare private-network / egress controls on the Worker deployment when available.

No certification theater

Until we complete a formal audit, we will not imply SOC 2 or ISO compliance. Ask for the current security summary, DPA, and subprocessors list instead.