Documentation / Security and privacy
Data protection in aishaa
In short: aishaa strictly separates the data of each account from other accounts, encrypts the connection details of mailboxes and plugins, and lets you as Account admin decide whether sensitive numbers are left out before text goes to the AI, whether voice messages are transcribed and whether callers hear a recording announcement. This article only describes what aishaa demonstrably does.
Where to find this
The choices you make yourself are on Account > Account settings, section Policy, and apply to the whole account. You set the recording announcement for telephony per number in the organisation’s telephony settings. If you want to turn off AI processing for a whole organisation, see Turn AI analyses on or off.
Who: Account admin for the account settings; Organisation admin for the organisation settings and telephony. Everyone benefits from the explanation in this article.
The Policy section on the Account settings page with the switches Redact sensitive identifiers for external AI and Transcribe WhatsApp voice messages with the Maximum length (minutes) field.
Separation between accounts and organisations
- Each user belongs to exactly one account and only sees the organisations of that account that an Account admin has given them access to. Data of other accounts cannot be seen or edited, not even via the connection with Claude or ChatGPT.
- Tickets, conversations, channels and AI settings belong to an organisation. Users, contacts, labels, macros, knowledge documents and the policy belong to the account and are shared by all organisations of that account.
- Reports and searches only show the organisations you have access to. See Roles and permissions.
Signing in and access
Signing in goes through a secure sign-in service with an email address and password. Passwords are not stored in aishaa. Roles determine what someone may do; only an Account admin can invite users, change roles and revoke access. See Signing in, identity and passwords.
Encryption of connection details
The details aishaa uses to connect to your mailboxes (Google, Outlook), your SMTP server and your webshop or other plugins are stored encrypted. An SMTP password is never shown again in aishaa after it has been saved; when you edit an SMTP connection, it says leave empty to keep current.
Leaving out sensitive numbers for external AI
aishaa uses an external AI provider to understand messages and write replies, and an external translation service for translations. In Account > Account settings, section Policy, you find the switch Redact sensitive identifiers for external AI.
| Setting | Meaning |
|---|---|
| Off (default) | Messages go to the AI provider and the translation service unchanged. |
| On | Valid BSNs (Dutch citizen service numbers), payment card numbers and IBANs are replaced before text goes to the AI provider or the translation service. In translations aishaa restores the original BSN locally, so the translated text remains complete for your team. |
The explanation in the app reads: Valid BSNs, payment card numbers and IBANs are replaced before text is sent to the AI provider or DeepL. BSNs are restored locally only in translations. Every change in this section is saved immediately.
Voice messages and phone calls
Separate choices apply to spoken messages and calls, because audio goes to a speech service for transcription.
WhatsApp voice messages
With Transcribe WhatsApp voice messages (on by default), aishaa converts voice messages into text, so the text appears below the audio and aishaa can understand the message. For this, the audio goes to the speech service aishaa uses. With Maximum length (minutes) (1 to 60, default 10) you decide up to what length aishaa transcribes; longer audio remains a download only. Turn the switch off if you do not want speech to go to the speech provider. A transcript carries the note Transcribed automatically by aishaa; it may contain mistakes.
Telephony
If the Telephony feature is active, these choices apply per phone number:
| Setting | Meaning | Default |
|---|---|---|
| Record calls | Answered calls are recorded (caller and colleague on separate tracks) and stored securely in aishaa. | On |
| Transcription | Off, After the call, Live during the call or Live, refined after the call. Only recorded calls are transcribed; the audio goes to the speech service aishaa uses. | See Number settings |
| Play recording announcement at call start | Callers hear an announcement before the call is connected. The app states: Required by GDPR when calls are recorded or transcribed. | On |
| Recording announcement | Your own text for the announcement. Empty means the default text: “This call may be recorded and transcribed so that your question can be handled properly.” | Empty |
Turning AI analyses off completely
If you want aishaa to stop sending messages to the AI provider for an organisation, the AI analyses can be switched off for that organisation. You cannot switch this on or off yourselves. Contact the aishaa team via the aishaa support chat in aishaa (menu Chat, conversation aishaa support) or via support@aishaa.nl. No more proposals, classifications or summaries are then created and the weekly check of your website stops. See Turn AI analyses on or off.
What aishaa learns from you
aishaa builds a short AI customer profile for each customer (What aishaa knows about this customer) and learns facts per topic from what colleagues change in its proposals, never anything about one single case or one single customer. You see the customer profile on the customer profile and can delete it there or have it rebuilt; you see the learned facts under What aishaa knows. What aishaa changes in the configuration is shown in the changes feed. See Audit trails: ticket, customer and configuration.
Usage statistics
aishaa measures how the app and the connection with Claude or ChatGPT are used in order to improve the product. Those measurements contain no customer text, no email addresses, no ticket numbers and no file names.
Good to know
- aishaa has no two-step verification, no SSO and no IP restriction for signing in.
- There are no configurable retention periods and no export function for data. See Retaining and deleting data.
- Redaction of sensitive numbers only works for valid BSNs, payment card numbers and IBANs. Other personal data (names, addresses, phone numbers) does go to the AI provider; it is needed to be able to help a customer.
- Redaction applies to the whole account. An organisation cannot deviate from it.
- You will not find a data processing agreement or privacy statement in the app. Contact the aishaa team via the aishaa support chat in aishaa (menu Chat, conversation aishaa support) or via support@aishaa.nl.
- Some objects on a customer are confidential, such as a recorded advice conversation. Only colleagues from the Team lead role and the person who created the object see the content; others only see that it exists. aishaa does work with the content. See The customer profile.