Encryption

Sensitive data

While all bot, user, and human agent messages are encrypted while in flight, by default, all messages, including user input, are visible in a bot's logs, and in the transcript returned by the /messages and /messages/<message_id> API endpoints.

If your users will be entering sensitive information (e.g. credit card info, a social insurance number, or a description of a medical issue) you can mark those inputs as sensitive which will encrypt the input on the client side. The data will appear encrypted in the bot logs, and in messages returned from the /messages and /messages/<message_id> endpoints.

Encryption keys

The encryption keys required to decrypt these messages expire and are deleted after 24 hours, meaning messages encrypted with those keys will remain permanently encrypted.

Using encryption with a customer service integration

A user's sensitive input will be decrypted before sending the message to the agent so that the agent can read the message. The message, though, is still processed by Meya's standard end-to-end encryption which protects the message while in flight.

Marking input as sensitive

All meya.input_* components have a property encrypt which, when set to sensitive, will encrypt the user's response. This encryption happens before the data is sent anywhere. The data will be encrypted everywhere, including in your bot's logs.

Encryption example

In this example, user.email will appear as an encrypted string.

states:
		get_email:
        component: meya.input_string
        properties:
            text: Enter your email address
            output: email
            scope: user
            encrypt: sensitive
    print_email:
        component: meya.text
        properties:
            text: "{{ user.email }}"

The user's response is encrypted in the logs:

The print_email state prints the user's email. In the logs, this send.message event still appears encrypted:

On the client side, the message is decrypted on arrival. Here's how the full interaction appears to the user:

Meya Web

Meya Web provides extra encryption features.

Encrypt received media

When this box is checked, all media (e.g. images, videos, files, audio) will be encrypted even if a media input component does not have encrypt set to sensitive.

Encrypt received events when thread is paused

When this box is checked, all received events will be encrypted while the bot is paused, for example, when the user is talking to an agent.