Privacy & Security at Manychat
Certifications
Manychat adheres to global security standards. Our security controls undergo external independent audits on an annual basis.
Cloud Security Alliance
Manychat is listed as a Trusted Cloud Provider in the Cloud Security Alliance (CSA) STAR Registry.
ISO/IEC 27001
Our Information Security Management System (ISMS) has been certified against the ISO/IEC 27001:2022 standard. You can view Manychat's ISO/IEC 27001:2022 certificate here.
SOC 2 Type II
Manychat is SOC 2 Type 2 compliant. If you are our customer or just considering incorporating Manychat into your organization, please contact our Support to get our SOC 2 report.
ISO 42001
Our AI Management System has been certified against the ISO/IEC 42001:2023 standard following an independent audit by A-LIGN. You can view Manychat's ISO/IEC 42001 certificate here.
Cloud Security Alliance
Manychat is listed as a Trusted Cloud Provider in the Cloud Security Alliance (CSA) STAR Registry.
ISO/IEC 27001
Our Information Security Management System (ISMS) has been certified against the ISO/IEC 27001:2022 standard. You can view Manychat's ISO/IEC 27001:2022 certificate here.
SOC 2 Type II
Manychat is SOC 2 Type 2 compliant. If you are our customer or just considering incorporating Manychat into your organization, please contact our Support to get our SOC 2 report.
ISO 42001
Our AI Management System has been certified against the ISO/IEC 42001:2023 standard following an independent audit by A-LIGN. You can view Manychat's ISO/IEC 42001 certificate here.
Official Meta Partner
As an official Meta Business Partner, Manychat complies with Meta's security policies and guidelines, including Meta Platform data security requirements and Data Use Policy. As part of the Meta Business Partner requirements, we go through periodic Data Use Checkups and Meta compliance audits.
Data privacy
We are committed to providing a high standard of privacy protection in compliance with international regulatory requirements.
General Data Protection Regulation (GDPR)
GDPR regulates the use of EU residents’ personal data.
California Consumer Privacy Act (CCPA)
CCPA secures privacy rights and sets consumer protection practices for California residents. Manychat is committed to working with you to fulfill any CCPA requirements.
Privacy Policy
Our Privacy Policy and Data Processing Agreement (DPA) are aligned with GDPR and other privacy-related regulations.
Our security practices
In transit
All data transmitted between your browser and Manychat is done so using strong encryption protocols. We support the latest recommended secure cipher suites to encrypt all traffic in transit, including use of TLS 1.2 protocols, AES256 encryption, and SHA2 hash functions, whenever supported by the clients.
At rest
Customer data at rest in Manychat’s production network is encrypted using FIPS 140-2 compliant encryption standards, which applies to all types of data at rest within Manychat’s systems—relational databases, file drives, backups, etc. Access to the secrets management system is authorized only for a small number IT infrastructure engineers.
Access
We manage access based on a "Need to know" and "Least privilege" principles. Our team members are only authorized to access data that they reasonably must handle in order to fulfill their current job responsibilities.
Vulnerability
We perform automated and manual application and infrastructure security testing to identify and patch potential security vulnerabilities. We also engage independent service providers to perform external penetration tests to assess the potential system security threats on an annual basis, at minimum.
Regular backups
User data is backed up continuously and encrypted. No matter what happens, your work will stay safe. There are also daily backups of the entire database that are stored separately from the main data center.
Incident response
We have incident handling policies and procedures to address service availability, integrity, security, privacy, and confidentiality issues. You can check our uptime and availability status at status.manychat.com.
Security FAQ
Are you ISO 27001, ISO 42001, or SOC 2 certified?
Is Manychat PCI DSS compliant?
Does Manychat participate in the EU-US Data Privacy Framework?
Do you perform penetration testing?
Do you have a Bug Bounty program?
Where do you store user data?
Do you encrypt my data in transit and at rest?
Do you sell or share our data with third parties?
Where can I find your list of subprocessors?
How long is my data retained, and what happens to it when I close my account?
How do you secure AI features and protect against AI-specific risks?
Try Manychat for free
Transform more conversations into sales, leads, and conversions today