Organization isolation
SHVYA's CRM, channel messages, configuration, documents, call data, support tickets and connected services use organization-scoped identities and server-side access checks. A customer-supplied organization ID is not permission to read or mutate that organization's records.
Protect credentials
- Keep Meta, Google, email, payment gateway and SHVYA API credentials in approved secret storage.
- Treat private webhook URLs as bearer secrets; rotate when exposed.
- Do not place passwords, OTPs or full authorization headers in screenshots or support replies.
- Revoke former employees' or contractors' access promptly.
- Confirm customer consent and provider policy before sending outbound messages.
Handle documents responsibly
Only upload content your organization has permission to store and share. Keep confidential internal files out of AI-Guided File Sharing. Verify that support attachments, sales documents, Vault records and Calendar files are accessed through their intended authorized views.
AI boundaries
The Playbook and knowledge files can inform replies, but cannot authorize cross-tenant access or bypass provider messaging rules. An external AI MCP connection is still bounded by user identity, scope, organization and approval.
Incident response
If a key, webhook URL or linked session is compromised, revoke/rotate it, review the corresponding connection and open a priority support ticket with redacted evidence. Do not ask support to disable security validation as a workaround.