Designed for payment data from day one.
The safeguards below are enforced in the product itself, not only described in a policy document.
Protection in layers
Every request passes each layer in order. Any layer can stop it.
- 01Card data maskedBefore any model, check or log sees them.
- 02AI kept apart from moneyIt proposes; no tool of its reaches a provider.
- 03Policy and safety limitsPolicy, refundable amount and limits decide.
- 04Workspace isolationScoped queries plus row-level security.
- 05Accounts and rolesSecond factors, roles, step-up codes.
- 06Audit trailWho, when and why, for every change.
What is enforced, area by area
Data protection
- No card numbers stored, ever
- IP addresses kept only as a country
- Personal data redacted from logs
- Provider keys envelope-encrypted
Access control
- Authenticator-app second factor
- Five member roles
- Step-up code for sensitive actions
- Sessions stored server-side
Money safety
- Each action recorded once, retried with the same key
- Refundable amount read from the ledger
- Emergency stop per workspace
- Limits that cannot be switched off
Transparency
- Policy version on every decision
- Facts stored with each decision
- Replay in the simulator
- Signed webhooks in and out
What Chargeless never does
- Store a card number or security code
- Let a language model call a payment provider
- Convert currencies at a rate of its own
- Act on a ticket after your team takes it over
- Treat a sender address alone as proof of identity
- Show payment details before identity is verified
Assistant · permissions
Allowed
Read the customer’s request
Ask a clarifying question
Draft the reply in your tone
Locked
Call a payment provider
Write to your records
Decide an outcome
No card numbers
Last four, brand and references only. Typed card numbers are masked first.
Strict workspace isolation
Enforced twice: in every query and by row-level security.
Two-factor sign-in
Authenticator codes; overrides and secrets ask for a fresh one.
Role-based access
Five roles, each seeing only what it needs.
Complete audit trail
Every publish, refund and settings change.
Signed in both directions
Outgoing webhooks signed, incoming ones verified.
Encrypted secrets
Envelope-encrypted, never shown again.
Minimal personal data
IPs kept as a country; personal data out of logs.
Have a security question? Ask us when you request access.
Start with low limits. Raise them when the record shows it works.
Start in test mode, run your policy against your own history, and go live when the results meet your standards.
- 1A test workspace on your provider’s test mode
- 2Your past requests replayed against your policy
- 3Live with low limits, raised as the record allows