Can the AI close a deal with no one reviewing it?

Only if your operation authorises it. Autonomy is configurable: you define which stages the agent handles alone and which ones must involve a person.

Do we have to change CRM?

No. Sailer connects to what you already use — HubSpot, Salesforce, Pipedrive, RD Station and proprietary systems over API — with two-way sync.

Is conversation data used to train models?

Conversation data is processed to run your account: replying, logging to the CRM and measuring. Any other use follows what the contract and the DPA set out. If your team requires a specific clause on model training, it goes into the contract.

Do you sign a DPA and answer security questionnaires?

Yes. We sign a data processing agreement (DPA), and an MSA when the engagement needs one, and we answer security questionnaires as part of vendor review.

How is messaging billed?

Meta's messaging is billed separately under the official API's rules and paid directly by the customer. Sailer adds no margin on that cost.

SECURITY CENTRE

What your security team needs before approving Sailer.

Sailer AI runs on Meta's official WhatsApp Business API and handles personal data under Brazil's LGPD. Here is where the operation runs, under which rules, who touches the data and what Sailer can evidence today.

PILLARS

How Sailer handles the channel, the data and autonomy.

Written so a vendor review can follow the channel, the data and how far the agent can go.

Official channel, accredited by Meta

Sailer is a Meta Tech Provider. The operation runs on the official WhatsApp Business API, under the platform's window, template and quality rules — not automation layered over a personal number, which is what exposes a company to bans and compliance risk.

Autonomy is configuration, not a black box

Your company defines how far the agent decides on its own, where a human steps in, and what it may never do. The playbook, the criteria and the tone of voice belong to the operation.

Integrates without replacing

Sailer connects to the CRM and systems you already run, with two-way sync. Going live requires no data migration and no tool swap.

Personal data protection

Sailer is GDPR and LGPD compliant. Processing is tied to a purpose, people can ask to access or delete their data, and a data processing agreement (DPA) is ready to sign.

Encryption in transit and at rest

Customer data is encrypted while it moves and while it is stored. Each customer's workspace stays isolated from the others.

Auditable record

Role-based access and an audit log of conversations and agent actions, exportable for internal review, with retention set in the contract.

COMPLIANCE AND CONTROLS

The names a security review looks for.

The duties and the controls Sailer operates under: familiar terms, describing how the platform is run.

Meta Tech Provider
Active accreditation with Meta to operate the WhatsApp Business API.
GDPR and LGPD
Sailer is GDPR and LGPD compliant. That covers purpose limitation, data-subject requests to access or delete data, and a data processing agreement (DPA).
SSO, SAML and SCIM
Sign-in through your identity provider, with SAML for single sign-on and SCIM for provisioning. Access inside Sailer is role-based and least-privilege, with an audit log of who did what.
Encryption in transit and at rest
Customer data is encrypted while it moves and while it is stored. Workspaces stay isolated per brand.

DATA HANDLING

Where the data lives and who touches it.

A plain record for vendor questionnaires. Anything that depends on each customer's contract or environment is detailed during vendor review.

Where the data lives and who touches it.
Hosting region	Cloud infrastructure with controlled access. Provider and region are shared during vendor review, with the documentation your security team asks for.
Encryption	Customer data is encrypted in transit and at rest.
Conversation retention	Set by contract, according to the purpose of processing and your operation's rules.
Sailer team access	Role-based, least-privilege access, with an audit log of who did what.
Subprocessors	A list with the purpose of each subprocessor, including Meta for messaging, provided during vendor review and covered in the DPA.
Messaging	Meta (official WhatsApp Business API). Billed by Meta directly to the customer, at cost, under the API's rules.
Privacy policy and terms	Published and linked in the site footer.

SECURITY QUESTIONS

The ones that come up most in vendor review.

Can the AI close a deal with no one reviewing it?: Only if your operation authorises it. Autonomy is configurable: you define which stages the agent handles alone and which ones must involve a person.
Do we have to change CRM?: No. Sailer connects to what you already use — HubSpot, Salesforce, Pipedrive, RD Station and proprietary systems over API — with two-way sync.
Is conversation data used to train models?: Conversation data is processed to run your account: replying, logging to the CRM and measuring. Any other use follows what the contract and the DPA set out. If your team requires a specific clause on model training, it goes into the contract.
Do you sign a DPA and answer security questionnaires?: Yes. We sign a data processing agreement (DPA), and an MSA when the engagement needs one, and we answer security questionnaires as part of vendor review.
How is messaging billed?: Meta's messaging is billed separately under the official API's rules and paid directly by the customer. Sailer adds no margin on that cost.

Need documentation to move this forward internally?

You start with Sofia, our AI. She takes down what your team asked for and books time with a specialist.

Talk to a specialist