Security — Overview

HaveAI uses multiple security measures to protect access to your account and the information processed on the platform. These measures cover sign-in verification, team permissions, connection security and content controls.

Measures That Protect Your Account

• Password protection: Your passwords are not stored as plain text. A one-way hash is created to be checked during sign-in. When setting a password, you must follow the security rules shown on screen.
• Two-factor authentication: You can use additional verification with an app code or, on supported sign-ins, an email code.
• Session control: When you sign in to your account again, the access of the previous sign-in becomes invalid. You can review and end session records from the security settings.
• Team permissions: You can give each team member roles and permissions suited to their duties. Each person must sign in with their own account.

For setup and usage steps, review the Two-Factor Authentication, Session Security and Roles and Permissions guides.

Connection and Application Security

You connect to HaveAI over HTTPS. HTTPS encrypts the data transfer between your browser and the server.

Encryption is used for storing certain fields, such as the secret access information used in bot connections. This information is the credentials needed to connect to the relevant service; it should not be shared.

The application also uses protective HTTP headers and request limits. These measures help reduce some browser-based risks and repeated abuse attempts. If you have made many failed sign-in or verification attempts, wait for the time stated on screen and try again.

AI and Content Protection

HaveAI uses detection and control components for inappropriate content, unwanted messages and certain personal data formats. These controls work together with the assistant's behavior instructions and the information your business provides.

Personal data detection can recognize certain formats such as an ID number, card number, IBAN, phone and email. In operations where masking is applied, the detected information is hidden. This feature does not mean all personal data is automatically removed in every case. You also need to separately manage the customer information you collect to communicate.

Regularly check your assistant's answers. When you see a wrong or inappropriate answer, review the relevant training information and behavior instructions.

Secret Information Scan in Training Content

In document upload and website crawl operations, the texts prepared for training are scanned for certain API key, password and private key formats. Detected information is masked in the training text.

Automatic scanning may not recognize every secret. Before uploading a document or adding a page to training, check the content. Remove passwords, private access keys and information that should not be disclosed to customers.

What You Can Do

For personal data operations, review the KVKK and GDPR guide.

Related Topics