Security
日本語wecool implements the following security measures to protect the information of customers using our chat widget, API, and dashboard. This page is updated as our measures evolve.
Data Protection
- Encryption in transit
- All traffic is encrypted with TLS (HTTPS). The API and dashboard are served through Cloudflare's edge network.
- Password protection
- Passwords are never stored in plaintext. They are hashed with PBKDF2 (SHA-256, 100,000 iterations) and a random salt, and verified using constant-time comparison.
- API key protection
- Only the SHA-256 hash of each API key is stored. The plaintext key is shown once at issuance; afterwards only its prefix (the first few characters) is visible.
- Data at rest
- Data is stored on Cloudflare infrastructure (D1 / KV) with platform-level disk encryption. Additional application-level encryption for sensitive fields is currently in preparation.
Authentication & Access Control
- Account registration
- Email verification is required to activate an account.
- Session management
- Sessions are managed as JWTs in HttpOnly / Secure cookies to mitigate token theft via XSS.
- API key authentication
- Widget embeds authenticate with API keys. Each key can be restricted to an allowlist of origins and can be revoked from the dashboard at any time.
- Role separation
- Administrator and regular-user roles are separated, restricting access to administrative features.
- Rate limiting
- API requests are rate-limited at three levels — per minute, per day, and per month — to prevent usage beyond plan limits.
Infrastructure
- Hosting
- The service runs on Cloudflare Workers / D1 / KV / Pages. We do not operate physical servers and rely on Cloudflare's managed infrastructure.
- Subprocessors
- We use Cloudflare (hosting and data storage), OpenAI (chat response generation), Stripe (payment processing — card data is handled directly by Stripe and never passes through our servers), and Resend (email delivery). Please refer to each provider's published information for their security certifications.
Monitoring & Incident Response
- Audit logs
- Authentication events, administrator actions, and billing operations are recorded in audit logs and retained for 365 days (entries past the retention period are deleted automatically).
- Usage monitoring
- API usage is recorded and tied to rate limiting to detect and curb anomalous activity. We also collect CSP (Content Security Policy) violation reports.
- Incident response
- Report security incidents to the contact below. Upon receipt, we assess the impact and take the necessary actions, including reporting.[email protected]
Vulnerability Reporting
- Contact
- If you discover a vulnerability, please contact us at the address below instead of reporting it in public (e.g. GitHub issues).[email protected]
- Response times
- We aim to acknowledge reports within 7 days. Fixes are prioritized by severity and addressed in order. As a small team, we may need some time to respond.
- Coordinated disclosure
- Please practice responsible disclosure and refrain from publishing details before a fix is released. We do not currently run a monetary bug bounty program.
Compliance
- Third-party certifications
- We do not currently hold third-party certifications (ISO 27001 / SOC 2, etc.). We are working toward the organizational readiness required to obtain them.
- Personal data
- Personal data is handled in accordance with applicable data protection laws, including the Act on the Protection of Personal Information (Japan).
Data Deletion & Account Closure
- Account deletion
- You can delete your account at any time from the profile page in the dashboard. Password re-confirmation is required to prevent accidental deletion, and paid plans are cancelled before the account is closed. Upon deletion, we immediately mask personal information such as your email address and deactivate the account. Usage statistics are retained in a form that is no longer linked to you, and audit logs are kept as legal records and deleted automatically after the 365-day retention period. If you have any questions, contact us at the address below.[email protected]
Last updated: 2026-07-09