Security

What is in place, what is underway, and what we do not have yet.

Campfire protects customer conversations and workspace data with tenant isolation and encryption. This page keeps controls that exist today apart from audits still in progress and from capabilities we have not built.

Controls in place today

Each item below is implemented in the product today.

Row-level tenant isolation: Postgres row-level security is enabled on workspace tables such as conversations, messages, tickets and users, and server procedures are scoped to the caller’s organization.
Encryption in transit and for stored secrets: Production responses send Strict-Transport-Security (HSTS) so browsers keep using HTTPS. AI provider keys, webhook secrets, channel credentials and integration tokens are stored encrypted with AES-256-GCM.
Workspace audit log: An organization-scoped audit log records the actor, action, resource and metadata for team, team inbox, routing rule, assignment and widget configuration changes. It does not cover every action in the product.
Data Processing Addendum and subprocessor list: A published Data Processing Addendum defines Campfire’s processor role, security measures and the bring-your-own-AI boundary, and the subprocessor list is public.; Data Processing Addendum Subprocessors Privacy policy
GDPR data export and deletion: Authenticated endpoints let a signed-in user export or delete their own account data (/api/gdpr/export and /api/gdpr/delete).
Widget domain allowlist and install receipts: You choose which domains may use your widget, and each workspace gets an install receipt with install and first-resolution timings that never stores message content.
AI labelling in the widget: AI replies in the widget can carry an “AI-generated” label and a High, Moderate or Low confidence indicator. Both are on by default.

Audit underway — not yet achieved

Nothing in this section is a certification we hold.

SOC 2 Type II — audit in progress (not yet certified): We have no SOC 2 report or certificate today. We claim no SOC 2 badge or attestation until the third-party auditor’s report is complete, and we will link it from this page when it exists.

What we do not have yet

Plain statements of what Campfire does not offer today.

No SAML 2.0 or SCIM: Single sign-on through your identity provider (SAML 2.0) and SCIM directory provisioning are not built yet.
No completed SOC 2 Type II certification: The audit above is in progress. Until it completes, we do not hold the certification.
No data-region choice on hosted cloud: The hosted service does not offer multi-region data residency selection. Primary infrastructure runs on Supabase, as described in the Data Processing Addendum. Self-hosting is available under the MIT licence if you need to control where data lives.

Report a vulnerability

Email security@campfire.is. Processing terms are in the Data Processing Addendum and the subprocessor list.