Security at Maxy

Maxy is designed to protect information processed through the platform using reasonable technical and organizational security measures.

We work to protect customer information against unauthorized access, alteration, disclosure, loss, or destruction.

Security controls may include authentication, authorization, access restrictions, database controls, secure communications, and customer-level data separation.

Maxy applications and APIs are designed to use HTTPS/TLS for communication between clients and our services.

HTTPS helps protect information transmitted between your browser, website, chatbot, and backend services from unauthorized interception.

We recommend accessing Maxy only through secure HTTPS connections.

Access to protected Maxy functionality requires authentication and appropriate authorization.

Maxy uses role and account information to help control access to administrative and customer functionality.

Administrative functionality is restricted to authorized users according to their assigned permissions.

Customers are responsible for protecting their account credentials and notifying us if they believe their account has been compromised.

Maxy is designed as a multi-tenant platform. Customer data is associated with a specific client or account identifier.

Documents, FAQs, embeddings, conversations, leads, and other customer information are associated with the applicable customer account.

Access controls are used to help prevent one customer from accessing another customer's protected information.

Businesses using Maxy may upload documents and create private knowledge bases for their chatbots.

Uploaded documents may be processed into text chunks and vector embeddings to support semantic retrieval.

These materials are associated with the applicable customer account and are intended to be used only for that customer's chatbot functionality.

Maxy does not intentionally make one customer's private knowledge base available to another customer.

Maxy uses managed database infrastructure to store application data.

Database access is restricted to application and administrative functionality that requires it.

Customer-specific records use client identifiers and access controls to help maintain appropriate separation between accounts.

Vector embeddings used for document and FAQ retrieval are stored with the associated customer data and are used to support semantic search.

Maxy uses third-party technology providers to provide AI generation, embedding generation, hosting, databases, and other infrastructure required to operate the platform.

Depending on the functionality being used, information necessary to generate an AI response may be processed by an AI service provider.

We do not sell customer information to AI providers or authorize service providers to use Maxy customer information for their own advertising purposes.

Additional information about data processing can be found in our Privacy Policy.

Maxy uses cloud infrastructure to host and operate application services.

Our production architecture separates frontend application hosting, backend services, and database infrastructure.

Infrastructure providers may provide additional security, availability, monitoring, and access-control capabilities as part of their services.

Maxy may monitor service usage and request activity to help prevent abuse, protect platform availability, enforce subscription limits, and manage resource consumption.

Usage information may include message counts, token usage, timestamps, and account-level usage information.

These controls help protect the platform and provide customers with predictable service usage.

Administrative functionality is protected through authentication and role-based authorization.

Access to customer-management functionality is restricted to authorized administrative users.

Administrative access is intended to be limited to functionality necessary for operating and supporting the Maxy platform.

We may monitor application activity, service usage, and technical events to identify operational problems, unauthorized activity, abuse, or potential security issues.

Security-related information may be reviewed when necessary to investigate incidents, troubleshoot problems, protect users, or maintain the reliability of the Services.

If we become aware of a security incident affecting information processed through Maxy, we will assess the incident and take reasonable steps to contain, investigate, and remediate it.

Where notification is required by applicable law, we will follow the applicable notification requirements.

Security is a shared responsibility between Maxy and its customers.

Customers should:

• Use strong and unique account passwords.
• Protect account credentials.
• Limit administrative access to authorized personnel.
• Avoid uploading information they do not have the right to process.
• Keep systems used to access Maxy reasonably secure and up-to-date.
• Notify Maxy if they suspect unauthorized access to their account.

While we take reasonable steps to protect the Maxy platform, no internet service, application, database, or electronic storage system can be guaranteed to be completely secure.

We therefore cannot guarantee that unauthorized access, disclosure, alteration, or loss will never occur.

Our security practices may evolve as the platform, technology, threats, and applicable requirements change.