Reviewed in November 2026: 13 of 13 findings fixed
Your customers’ conversations, kept safe.
Two-step sign-in for every agent. The chat works only on websites you allow. Delete a customer’s data yourself, any time.
Sign-in and access
Two-step sign-in
Agents can add a code from an authenticator app. An owner can require it for the whole team. Ten one-time recovery codes are issued.
Roles
Owners, admins and agents. Agents see the chats of their groups; only an owner deletes data or resets a member’s two-step sign-in.
Passwords and sessions
Passwords are stored only as Argon2id hashes. Sessions use secure, HttpOnly cookies, and a password reset signs out every other session.
Every account kept apart
Every organization’s data is separated in the database itself, with row-level security on every table, so one account’s query can’t read another’s chats.
Delete it yourself
An owner removes a visitor’s data, or all chat data, from Settings.
Files
Stored per chat, downloaded through short-lived links.
Signed webhooks
Every delivery is signed with HMAC-SHA256 and a timestamp.
How we check our security
Stored in Singapore
Your customers’ chats stay in Asia. Chat data is stored in Singapore.
Reviewed and load tested
An independent review of the backend in November 2026 found 13 issues; all 13 are fixed, each with a test. A load test held 10,000 connections and lost no messages when a server was killed mid-test.
Report a problem
Found a security issue? Write to support@mlive.chat with “Security” in the subject.
We don’t show certification badges we don’t hold. Read our Data Processing Agreement and Privacy Policy.
