Security
Understand what the development build can access.
The local development build reads prepared examples on one computer. It is not open for public download and does not connect to customer channels or a production database.
Chawo is preparing for launch. We are taking early-access requests; AI and channel connections are not available yet.
Scenario review stays on one computer.
The local development build handles scenario design and review in one process. It makes no calls to a live messaging runtime.
Prepared examples, without production credentials.
Conversation records are redacted or synthetic. The development build has neither credentials nor a read path to a production database.
A review does not contact a customer.
The development build has no write path to a messaging channel, CRM or advertising system. Replaying a prepared record does not send a message or change a customer record.
Only requests from the same computer are accepted.
The local development build accepts loopback requests and rejects other Host values with status 421. This limits the addresses through which that local process can be reached.
Hosting needs its own protections.
The local development build does not yet have operator authentication or tenant isolation. Both are prerequisites for the planned hosted service. A data processing agreement is planned with that service.