Encryption in transit
Production traffic is terminated over TLS and internal service access is restricted by cluster networking.
Review signals
Trust the system the same way you review any operational platform
The strongest trust story is consistency: one onboarding flow, one billing owner, and one visible audit trail from activation through launch.
- Buyer review
- Trust package available
- Data handling
- Encrypted in transit + at rest
- Audit history
- Action-level visibility
- Operational controls
- Approvals + escalation
Architecture, data flow, and billing ownership walkthroughs available on request
Workspace-scoped access and secure payment collection support controlled launches
Sensitive workflow actions can be reviewed by actor, time, and outcome
Humans can review exceptions instead of forcing automation through
Capabilities
What security, finance, and CX teams can review before launch
These controls matter most when a platform can take real action in your commerce stack.
Security architecture
ResponseCX is built for controlled operational work, not a black-box chatbot deployment.
- Role-aware access for CX, finance, and operations teams.
- Secure billing ownership with payment methods scoped to the organization.
- Documented launch paths for write-access workflows and human escalation.
Governance toolkit
Teams can review how the product behaves before enabling sensitive workflows in production.
- Approval thresholds for refunds, cancellations, exchanges, and escalations.
- Billing contacts, invoices, and subscriptions tied to the workspace owner.
- Review materials for procurement, legal, and vendor-risk conversations.
Audit-ready operations
Every workflow should leave a trail that operators and reviewers can understand quickly.
- Action history with actor, workflow context, and timing.
- Searchable records for operational reviews and exception handling.
- Exports and evidence packets for internal sign-off or external reviews.
Evidence register
Clear status for every public trust claim
Implemented controls and independent certifications are different things. This register makes that distinction explicit so security teams know what can be verified now and what still requires buyer review.
ControlStatusEvidence statement
Implemented
Encryption at rest
Kubernetes secrets, primary databases, and production backups use encryption at rest.
Access controls and audit history
Organization scoping, role-aware permissions, approvals, and security-relevant audit events are built into the platform.
Availability objective
The production SLO targets 99.9% availability with health probes, multiple replicas, monitoring, and rollback controls.
SOC 2
ResponseCX maintains SOC 2-aligned technical controls. Certification is not represented here without a current independent report.
GDPR and CCPA
Privacy-supporting controls are available; applicability and contractual requirements are confirmed during buyer review.
Payment data
Payment card collection is hosted by Stripe so card details do not pass through ResponseCX application servers.
Evidence policy v2026-09-01: Only controls marked verified may be described as certified or compliant. Implemented controls must be described as controls, readiness, or supported practices.
Reliability evidence
Targets, instrumentation, and proof are kept separate
This register shows what is contract-verified, what is instrumented in production, and where a reproducible benchmark artifact is still required.
Concurrent customer conversations
Target: 500 concurrent sessions with <1% server errors
No current evidence artifact — this target is not published as an achieved result.
Support email ingestion
Target: 99% visible in Chat Desk within 30 seconds
Evidence: config/platform-slos.json#support_email_ingestion
Long-running workflow completion
Target: 99.5% successful terminal completion excluding approved escalation
Evidence: config/platform-slos.json#workflow_completion
Realtime voice turn latency
Target: Published p50 and p95 latency under controlled network conditions
No current evidence artifact — this target is not published as an achieved result.
Dependency failure and recovery
Target: Fail closed, preserve work, and recover without duplicate customer actions
Evidence: npm run resilience:check
Organization isolation
Target: Cross-organization reads and writes rejected across privileged surfaces
Evidence: npm test
Benchmark policy v2026-09-01: Targets are not results. A scenario may be described as proven only when an artifact is attached, the run is reproducible, and the result is within its freshness window.
Playbooks
How ResponseCX supports buyer reviews and controlled rollouts
Security onboarding
Architecture and control review
Walk security and IT stakeholders through data flow, access boundaries, and rollout controls.
- Review how organization access, billing ownership, and workflow permissions are modeled.
- Map customer systems, integrations, and escalation boundaries before launch.
- Align on who approves operational actions and how exceptions are routed.
Security reviewers get a concrete deployment model instead of marketing claims.
Commercial readiness
Billing and procurement alignment
Give finance and procurement teams clarity on pricing, invoicing, and ownership before go-live.
- Document self-serve plan behavior, charges due today, and invoice timing.
- Confirm billing contacts, payment-method ownership, and portal access.
- Escalate to guided review when enterprise procurement or commercial terms are needed.
Commercial conversations stay aligned with how the product actually activates.
Operational review
Audit and exception workflows
Keep sensitive actions visible so teams can inspect what happened and why.
- Review action logs by workflow, operator, or timeframe.
- Export evidence for internal controls or vendor-risk follow-up.
- Refine approval policies when exceptions reveal process gaps.
Ops, security, and finance teams share one view of system behavior.
Proof
Trust improves when pricing, ownership, and operations line up
Buyer readiness
Security brief + review path
Materials that support real reviews
ResponseCX is easier to buy when trust, billing, and rollout questions are answered in one place.
Use the trust center, pricing page, and onboarding flow together during evaluation.
Commercial controls
Org-scoped billing
Finance ownership stays explicit
Payment methods, invoices, and subscriptions stay tied to the organization rather than individual operators.
That keeps billing changes and recovery paths visible to the right team.
Operational visibility
Approvals + escalation
Automation does not mean invisible decisions
Sensitive workflows can escalate to a human with context so teams preserve judgment where it matters.
A clean escalation path is part of the trust story, not an exception to it.
Next step
Review pricing, then launch through the canonical onboarding flow
Starter and Growth are designed for controlled self-serve activation. Enterprise can add a guided trust and procurement review without changing the product path.