Trust and security
What we do with your customers' data, in plain words
Suhep is made and run by Hostao L.L.C. This page lists what is true today. When something changes, we update this page and the DPA.
- Encryption in transit. Every connection to Suhep uses TLS 1.2 or higher.
- Encryption at rest. Database encryption with AES-256.
- Role-based access. Team members see what their role allows, and admin access needs multi-factor sign-in.
- Breach notice. If personal data is affected, we tell you without undue delay and within 72 hours of becoming aware, as set out in the DPA.
- Your rights. Access, correction, deletion, restriction, portability and objection requests go to privacy@suhep.com.
How the AI handles customer conversations
- Answers come from your content. The AI uses your published help articles and the current conversation.
- Risky topics go to people. Billing, account access, sensitive or uncertain requests become a ticket for your team instead of an AI answer.
- Bring your own key. On Pro and Business you can connect your own OpenAI, Anthropic or Gemini key, so AI calls run under your own provider account and terms.
Sub-processors
These are the kinds of providers that process data for Suhep. The DPA explains the safeguards and how we tell you about changes.
| Provider type | Purpose | Location |
|---|---|---|
| Application infrastructure | Hosting, database, sign-in and delivery of the Suhep app | United States / EU where configured |
| Communications delivery | Email, WhatsApp and notification delivery where you enable them | United States / EU / India where configured |
| AI model provider | Writing AI answers. With BYOK, calls use your own provider account instead | Depends on the provider |
| Payments (Razorpay) | Checkout and billing for paid plans; card details are entered with Razorpay, not stored by Suhep | India |
Certifications
Suhep does not hold a SOC 2 report or an ISO 27001 certificate today, and we do not show badges we have not earned. If your review needs a security questionnaire, email us and we will answer it in writing.
Report a security issue
Email support@suhep.com with the subject "Security report". Please include the steps to reproduce and give us reasonable time to fix the issue before sharing it. Data protection questions: dpo@suhep.com.
Company
Hostao L.L.C, 30 N Gould St, Ste 4000, Sheridan, Wyoming 82801, USA. Grievance officer details are on the grievance page.