Built with security in mind.
This page lists the controls that are implemented in Caspira Live today. Where we do not hold a certification, we say so rather than implying one.
What is in the product today.
Each of these is shipped and in use, not planned.
Authenticated sessions
Sign-in issues a signed token in an http-only cookie backed by a server-side session record you can revoke.
Hashed credentials
Passwords are stored as bcrypt hashes with a work factor of 12. Plain text is never written to the database.
Role-based access
Seven roles from owner to viewer, with granular permission keys checked on every API route.
Audit trail
Sign-ins and changes to customers, tickets, and conversations are written to an append-only audit log.
Signed webhooks
Outgoing events carry an HMAC signature so your endpoint can verify the payload came from Caspira.
Abuse controls
Rate limiting on the public chat API, an origin allowlist, sensitive-word filtering, and a visitor blacklist.
Caspira Live does not currently hold SOC 2, ISO 27001, HIPAA, or PCI DSS certification. We describe only the controls that are implemented in the product today.
Access control
Permissions are enforced server side on every route, not only hidden in the interface. An agent who should not see billing cannot reach it by guessing a URL.
- Seven roles from owner through to viewer
- Granular permission keys checked on every API route
- Per-agent chat capacity and presence states
- Session records that an owner can revoke
Your data
Conversation data belongs to your workspace. You can export it, and every meaningful change to a record leaves an audit entry.
- Customer records and transcripts are scoped to your workspace
- Sign-ins and changes to customers, tickets, and conversations are written to an append-only audit log
- Conversation exports are available so your data is not locked in
- Sensitive-word filtering and a visitor blacklist for abusive traffic
What we do not claim.
Plenty of vendors imply compliance they have not earned. We would rather be the one you can check.
Caspira Live does not currently hold SOC 2, ISO 27001, HIPAA, or PCI DSS certification. We describe only the controls that are implemented in the product today.
If your procurement process requires one of those certifications, tell us during a security review and we will be straight with you about timelines rather than working around the question.
Found a vulnerability?
Email support@caspirasolutions.com with the details and steps to reproduce. Please give us a reasonable window to fix an issue before disclosing it publicly.
Bring us your security questionnaire.
We will work through it with you and tell you plainly where a control exists and where it does not.