Security — Tuxon

Where your data lives

Tuxon is hosted in the European Union, in Germany. Each business's data is kept separate from every other business's — conversations, contacts, knowledge base content and settings are scoped to your account and are not reachable from another account.

Access control

Role-based permissions

Owner, admin, agent and viewer roles, so a team member sees the conversations and settings their job requires and not the rest.

Two-factor authentication

TOTP two-factor is available per user, with one-time backup codes. It works alongside a password or Google sign-in.

Google sign-in

Sign in with Google instead of a password, or link Google to an existing account.

Session handling

Authenticated sessions use signed tokens with an expiry you control.

Data protection

We process personal data to run the service you asked for, and we do not sell it or use it for advertising.
Requests to delete a person's data are honoured, including automated requests that arrive from Meta when someone removes your app from their Facebook or Instagram account. See data deletion.
A data-processing agreement is available, and our sub-processors are listed with what each one is used for.
SMS requires documented opt-in from recipients and honouring opt-out. How consent is recorded is set out on the SMS opt-in page.
Our full privacy policy is the authoritative document.

What we do not have

We do not hold ISO 27001 or SOC 2 certification, and we do not claim to. If a security review requires either, we would rather you know now than at signature.

We also do not offer single sign-on beyond Google, or data residency outside the EU.

Reporting a vulnerability

Write to support@tuxon.ai with enough detail to reproduce the issue. We will confirm receipt and keep you updated. Please do not test against another customer's account, and give us a reasonable window before disclosing publicly.

Security and data handling