How your data is protected
Where your data is kept, how sign-in, connections and stored secrets are protected, and what stays under your control.
Updated on
On this page
Your business entrusts Ha Tang with conversations, customer details, payments and the keys to your channels. This article explains how that data is protected and what you control yourself. The legal commitments are in our Privacy Policy and Data Processing Agreement.
Your data stays in your business
Everything you put into Ha Tang belongs to one business. Employees only see the businesses they were invited to, and inside a business only the modules their access allows (Employees and roles). API keys only ever reach the data of the business they were created in.
For the data you process about your own customers, you are the controller and Ha Tang is the processor: we process it on your instructions, to provide the service. Our Privacy Policy states that we do not use it for advertising or to train AI models.
Where data is stored
According to our Privacy Policy, production data is hosted in a data centre in Việt Nam, with encrypted backups. Outgoing email is delivered through Amazon Web Services. The policy lists the providers involved and how transfers outside Việt Nam are documented.
Signing in without passwords
- Ha Tang has no passwords that could be guessed, reused or leaked. People sign in with a 6-digit code sent by email, valid for 10 minutes, or with Apple, Google or GitHub (Sign in and sign out).
- After several wrong codes, the code stops working and a new one must be requested.
- A sign-in lasts 30 days and is extended while it is used. Removing an employee ends their access to the business at once.
Connections are encrypted
The dashboard, the API, the chat widget and the apps are only served over HTTPS, so what travels between your browser or phone and Ha Tang is encrypted.
Secrets are encrypted at rest
The secrets that let Ha Tang act for your business are stored encrypted (AES-256-GCM), and are decrypted only when they are used:
- the access tokens of your connected channels (Zalo, Facebook, Instagram, TikTok, WhatsApp, Telegram, LINE, X and the others);
- your bank connection and e-invoice provider credentials;
- webhook signing secrets and the Payments secret keys;
- the private DKIM keys of your sending domains;
- the chat widget's identity secret, push-notification keys and the AI provider keys you add.
API keys are stored only as a one-way hash. That is why a key is shown once, when it is created, and cannot be shown again (API keys).
You stay in control
| You can… | How |
|---|---|
| Decide who sees what | Roles and per-module access (Set an employee's module access) |
| Cut off a person immediately | Remove them in Settings → Employees |
| Stop a channel from reaching Ha Tang | Disconnect it in Customer Support → Channels |
| Pause a whole module without losing data | Turn it off in Settings → Business settings (Turn modules on and off) |
| Delete everything | Delete the business (Leave or delete a business) |
| Ask about your data or a customer's | Handle data requests |
Found a security problem? See Report a security issue.
Useful next steps
Was this article helpful?
Related articles
- Keep employee access safeGood habits for who can see and change what in your business, and a checklist for when someone joins or leaves.
- Handle data requestsWhat to do when a customer asks to see, correct or delete their data, and how to ask Ha Tang about your own data.
- Sign in and sign outHa Tang has no passwords. Sign in with a 6-digit code sent to your email, or with Apple, Google or GitHub.
Not finding what you are looking for?
Our team answers in the chat, in English or Vietnamese.