Support conversations often carry sensitive customer information. Naamo is built so your business stays in control of what the AI knows, what it says, and who can see it.
Naamo is onboarding private practices under Business Associate Agreements as part of our HIPAA compliance program, led by our Security Officer. Patient data is encrypted in transit and at rest, hosted in the US, never used to train AI, and limited to the minimum necessary. Practices should not send clinical details through Naamo until their BAA is in place.
Security and compliance are led by Co-Founder & CEO Emmanuel, who holds a master’s in Cybersecurity Management and Policy and serves as Naamo’s Security Officer.
Every incoming message from WhatsApp, Messenger, Instagram, Twilio, Slack, and Microsoft Teams is checked against the provider's signature before Naamo acts on it, so nobody can inject fake customer messages. Replies that fail to reach a customer are recorded in the conversation with the reason.
Naamo only answers from knowledge your business approved, and a second AI check compares each factual answer with that knowledge before it is sent. When the AI agent isn't confident, the check fails, or a conversation touches something sensitive, it hands off to a person on your team with full context instead of guessing. You can require approval before any reply about money or account access is sent. Naamo never verifies payments or asks customers for passwords, PINs, or card numbers.
Every minute, Naamo's supervisor checks that each customer message was answered, replies were delivered, approvals were decided, bookings reached the calendar, workflows ran, and tickets have an owner — and alerts your team when something didn't happen.
The database runs on Supabase in the United States; the application runs on our servers behind Cloudflare. The full list of providers is in the Privacy Policy, and deletion steps are on the Data deletion page.
If you believe you've found a security issue, write to [email protected]. We acknowledge reports within 2 business days and will keep you updated until it is fixed.