Security & control
Security and
AI access controls.
Understand who can access the work, what an agent can do and which deployment settings need to be verified.
Permissions and audience
Echo separates workspace management, customer support authorization and conversation access. Ticket assignment follows department eligibility and staff permissions. Customer portal access is scoped to the contact, ticket and explicit account role; a public website conversation does not automatically grant portal access.
Public replies and internal notes
Internal notes belong to the team’s work history. They must not be sent as customer replies. Configure agents and workflows to maintain the same audience boundaries as your staff.
Provider credentials and protected content
Provider settings and credentials are managed separately from marketing pages and customer-facing conversations. The application uses protected storage paths, and production requires durable encryption and Data Protection key configuration. Do not place secrets in website configuration or widget URLs. Review file and attachment access for the rules that apply inside each workflow.
Knowledge, tools and review
Give each agent the information and actions its job requires. Configure the relevant AI tool permissions and review controls, test unknown-answer behavior, and make escalation available when an action requires a person. AI output still needs a workflow appropriate to its risk and audience.
Questions to confirm for your deployment
- Where application data, model processing and backups are hosted.
- Which AI providers, subprocessors and retention rules apply.
- Who can authorize agents and change their knowledge or tools.
- How encryption keys, attachment scanning and access logs are operated.
- How data export, deletion and incident requests are handled.
This page describes product controls and deployment questions. It does not claim a certification, audit report, data residency guarantee or service-level commitment.
Read about AI review and escalation