At ESAA.AI, security is engineered into every layer of our digital workforce—from encrypted Google, Microsoft, and Meta OAuth token vaults to isolated tenant knowledge bases, prompt-injection defenses, and secure Model Context Protocol (MCP) runtime connections.
Databases, tickets & OAuth tokens encrypted.
Encrypted Web, Voice WebRTC & MCP streams.
Zero cross-tenant data or vector sharing.
Your data never trains public AI models.
All data transmitted between end-users, the ESAA.AI Control Panel, and third-party APIs is encrypted in transit using HTTPS / TLS 1.3. All persistent data—including customer tickets, knowledge base embeddings, and third-party OAuth access/refresh tokens (Google, Microsoft, Facebook, and WhatsApp Cloud API)—is encrypted at rest using AES-256 encryption with strict key rotation.
Every Business Tenant operates within a logically segmented workspace scoped by unique Tenant Identifiers. Your uploaded PDFs, FAQs, website syncs, and Grievance Portal tickets are strictly partitioned so that an AI agent deployed by one organization can never query, access, or leak data belonging to another organization.
When your AI Support Desk fetches live order, billing, student, or citizen records via an MCP Server, requests are authenticated using scoped, short-lived credentials and strict schema validation. The AI can only query record fields explicitly exposed by your MCP tool definition and requires user verification before returning account-specific details.
In accordance with Google Workspace and industry AI security standards, ESAA.AI enforces multi-layer input sanitization and system-prompt boundary protection to defend against adversarial prompt injection. If an AI agent lacks verified context to answer a query safely, it abstains from guessing and automatically logs a ticket in your Grievance Portal.
Voice AI streams operate over encrypted WebRTC (DTLS-SRTP) media channels for ultra-low latency and confidentiality. All Official WhatsApp Business API webhooks are cryptographically verified using HMAC-SHA256 payload signatures (`X-Hub-Signature-256`) to prevent spoofing or unauthorized message injection.
Internal administrative access follows strict least-privilege Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA). Human staff do not read customer conversations unless explicitly authorized by the Tenant for technical support. In the event of a confirmed security incident, affected Tenants are notified within 72 hours.
Summary of technical safeguards for Google, Microsoft, Meta, and Enterprise IT Reviewers
| Security Domain | Implementation Standard | Compliance Alignment |
|---|---|---|
| Data In Transit Encryption | TLS 1.3 (HTTPS) for Web/APIs; DTLS-SRTP for Voice WebRTC | Google API Policy & Meta Platform Terms |
| Data & Token Encryption At Rest | AES-256 encryption for PostgreSQL, Redis, and OAuth Refresh Tokens | Google Workspace & Microsoft Identity Standards |
| AI / LLM Data Governance | Zero training of foundational models on customer or OAuth data; prompt injection filters | Google API Limited Use (2026 AI Requirements) |
| User Data Deletion & Erasure | Automated Meta Deletion Callback + Self-Service & 7-Day SLA Portal | Meta Platform Terms (Sec 3.d.i), DPDP Act & GDPR |
| Backup & Disaster Recovery | Daily automated encrypted snapshots; High-Availability multi-zone failover | Enterprise SLA & Business Continuity |
