- Hosting
- Data and the media server are hosted at OVHcloud. Web traffic goes through Cloudflare, which protects the service against attacks.
- No recording
- Calls are neither recorded nor stored, and neither is the shared screen. Audio and video streams are encrypted up to the media server.
- GDPR
- Explicit consent when booking, a separate marketing opt-in, a configurable retention period for personal data and messages, and customer erasure on request. You decide what advisors see: the customer’s journey, with notice or with consent, and their screen, always with explicit consent.
- Screen sharing, under the customer’s control
- Advisors only see the customer’s screen with their explicit consent, and never take control. Input fields are masked, checkout and account pages are paused along with any pages you exclude, and the customer can stop sharing in one tap.
- Company SSO, included in the Enterprise plan
- Your advisors sign in with their company account, over SAML 2.0 or OIDC. Accounts can be created and deactivated automatically through SCIM 2.0, and your directory groups set each advisor’s role, store and topics. A deactivated account loses access immediately. Without SSO, advisors sign in with a one-time code sent by email.
- Accessibility
- Widget and console designed for WCAG 2.2 level AA: keyboard, visible focus, contrast, reduced motion. Accessibility has been a legal requirement for e-commerce in France since June 28, 2025.Source: Access42 timeline (in French)
- Roles and safeguards
- Head office configures and sees everything, store managers follow their team, advisors see their own calls. Per-device sessions, short sessions on shared store devices, abuse limits, caller blocking.
- DPA and security pack on request
- We answer your security questionnaires and send you our DPA, our list of subprocessors and the data flow diagram. Write to security@caast.tv.