Why Security Matters When Choosing Customer Communication Software

It is easy for security to become a final tick on the procurement list, particularly when a product has already impressed the people evaluating it. It deserves much more attention than that, and should be considered from the very start of the process.

When organisations start looking for new customer success and support software, there are usually some obvious questions to answer first: what does it do, what does it cost and will it work with the systems we already have?

All of those questions matter, particularly when budgets are under pressure and every new technology investment needs to demonstrate its value. There is another question, though, that is sometimes left until much later in the conversation, despite arguably being one of the most important considerations of all: how secure is it?

Live chat widget, conversational chatbots and AI have become an increasingly important part of how organisations communicate with their customers, residents, students, patients and service users.

A customer might begin by asking a straightforward question about a product or service, before going on to provide their name, address, account details or information about a problem they are experiencing. A resident might discuss an issue with their home, while a student could provide personal circumstances when asking for support. The conversation may appear to be just another customer interaction, but from an information security perspective it is still data that needs to be protected.

The information inside a conversation matters

One of the things that makes customer communication software different from some other business applications is the very nature of the information it handles. People tend to be more open when they are trying to solve a problem, particularly when they believe they are speaking directly to an organisation that can help them.

The organisation needs to know what information is likely to be collected, and where that information goes once it has been entered into the chat window.

• Who can access it?
• How is that access controlled?
• Where is the data hosted?
• What happens to it when it is no longer required?

These questions do not only apply to organisations with large IT departments. They are becoming increasingly important for businesses of all sizes as customer communication moves away from traditional email and telephone channels and towards digital conversations.

The software may be part of the customer service function, but the information it handles still belongs within the organisation's wider approach to data protection and security.

ISO 27001 tells you something important about the supplier

This is where ISO 27001 becomes an important consideration when choosing a technology provider.

ISO 27001 is an internationally recognised standard for information security management. It looks at the wider information security management system surrounding an organisation, including how risks are identified and managed and how appropriate controls are put in place.

An ISO 27001 certificate should never be viewed as a guarantee that nothing can ever go wrong, but certification demonstrates that an organisation has a structured framework for managing information security and that its approach has been independently assessed against the requirements of the standard.

For a business considering where to place customer conversations, that provides an important level of reassurance.

Click4Assistance operates an ISO 27001:2022 certified platform, with information security embedded into the way the business manages its technology and operations. The certification is maintained through ongoing assessment rather than being treated as something achieved once and then forgotten.

That last point is particularly important because security is not static. The threats facing organisations today are not identical to those they faced five or ten years ago, and the technology being used to communicate with customers continues to evolve.

GDPR responsibilities don’t disappear when you use a supplier

Data protection is another area where it is important to look beyond the software itself.

Organisations remain responsible for the personal information it collects and processes, even when a third-party technology provider is involved in delivering the service. That means procurement teams need to understand how their chosen supplier handles personal data and what arrangements are in place to support their own GDPR responsibilities.

It is easy to assume that GDPR is largely about the organisation's own website, CRM or internal database, but a customer conversation can contain exactly the kind of personal information that data protection legislation is intended to safeguard.

The questions therefore need to extend beyond whether the supplier says it is "GDPR compliant". Organisations should understand how information is processed, where it is stored, who has access to it, how access is controlled and what happens when information needs to be removed.

Those details may not be particularly exciting when you are sitting through a software demonstration, but they can become extremely important if something goes wrong.

Where your data is hosted matters

The location of the infrastructure supporting a communication platform is another question that deserves more attention than it sometimes receives.

For UK organisations in particular, UK data residency can provide greater clarity around where information is hosted and the environment in which it is being processed. It can also form an important part of an organisation's own procurement, contractual and compliance considerations.

Click4Assistance hosts its solution in the UK, giving customers a clear understanding of where their data is held.

When a supplier tells you that your information is secure, ask them to explain what that actually means in practice. Where is the data stored? Who has access to the infrastructure? How is access controlled? What happens when somebody leaves the supplier's organisation?

AI adds another dimension

The arrival of AI has made the security conversation even more important because not every AI system operates in the same way.

There is a considerable difference between an AI that answers customer questions using an organisation's knowledge base and an autonomous AI agent that has been given access to the internet, databases, operating systems, APIs and other business applications.

The more systems an AI can access, the more carefully those permissions need to be managed.

That is why organisations considering AI-powered customer engagement tools should ask what the AI can access and what it can actually do. Can it browse the internet? Can it access internal databases? Can it execute code? Can it send emails? Can it change information within another system? Can it call external services?

These questions are much more useful than simply asking whether a platform is "AI enabled".

With ARTI, the Click4Assistance AI Agent, the approach is deliberately more controlled. ARTI works from the knowledge provided by the organisation rather than independently searching the wider internet. It cannot execute code, install software, send emails or modify files, and it cannot access customer systems unless a specific integration has been deliberately configured and permission has been granted.

That distinction is important because an AI does not need access to everything in order to be useful in customer service.

Good security is also about controlling people

Of course, protecting customer information is not simply about securing the technology itself. Organisations also need to consider who within the business can access that information and what they are permitted to do with it.

Role-based permissions are particularly useful here because they allow access to be aligned with someone's responsibilities. A customer service adviser may need to see conversations relevant to their work, while an administrator may require additional permissions to manage the platform.

Audit logs add another layer of accountability by providing visibility over activity within the solution. If an organisation needs to understand who has accessed or changed something, there should be a record that allows it to investigate.

Authentication is equally important. Single sign on can make it easier for organisations to manage user access centrally, while multi factor authentication provides an additional layer of protection. These are now established security practices, but they remain important when dealing with customer communication systems.

Click4Assistance supports role-based permissions, audit logs, SSO and MFA, providing organisations with controls that help them manage access.

Security does not end when the certificate arrives

Perhaps one of the most important things to establish when choosing a software provider is how seriously the organisation treats security after the initial certification or procurement process has been completed.

A certificate can demonstrate that an organisation has met a recognised standard, but threats evolve, vulnerabilities are discovered and software changes continually, which means a responsible provider needs to keep testing and reviewing its environment.

Regular penetration testing is one part of that process. It provides an opportunity to test systems from the perspective of someone attempting to find weaknesses, rather than simply assuming that existing controls will continue to be effective indefinitely.

At Click4Assistance, regular penetration testing forms part of the wider security approach, alongside ISO 27001 certification, UK hosting, GDPR processes, role-based permissions, audit logs, SSO and MFA.

The important point is that these controls work together. There is no single feature that makes a platform secure, just as there is no single piece of technology that can eliminate cyber risk entirely. Security is an ongoing process of assessing risk, maintaining controls, testing systems and responding when circumstances change.

The questions worth asking before you buy

When you are comparing customer communication platforms, it is worth putting some straightforward security questions alongside the more obvious questions about features and price.

Ask the supplier whether they hold ISO 27001 certification and when it was last audited. Find out where your data will be hosted and how they approach their GDPR responsibilities. Ask how user access is controlled, whether the platform provides role-based permissions and whether activity is recorded through audit logs.

If the platform includes AI, ask what information the AI can access and what actions it can take. If integrations are available, establish exactly what permissions those integrations require and whether they are enabled by default or deliberately configured by the customer.

It is also worth asking about penetration testing, vulnerability management and what happens to your information when you eventually leave the platform.

None of these questions should be considered unreasonable. A reputable technology provider should expect prospective customers to ask them.

Frequently Asked Questions

Why does security matter when choosing live chat software?

Live chat can involve the collection and processing of personal and sometimes sensitive information. Customers may share contact details, account information or details about a problem they are experiencing, so the platform handling those conversations needs appropriate security controls to protect that information.

What does ISO 27001 certification mean?

ISO 27001 is an internationally recognised standard for information security management. Certification demonstrates that an organisation has established a structured approach to identifying and managing information security risks and has implemented appropriate controls. It is not a guarantee that security incidents can never occur, which is why ongoing monitoring and testing remain important.

Does GDPR apply to customer communication software?

Yes. If personal data is collected or processed through live chat, chatbots or other communication channels, GDPR responsibilities still apply. Organisations should understand which parties are the processor and controllers of the data, how their technology provider processes, stores and protects that information and ensure the appropriate contractual and organisational arrangements are in place.

Why does UK data residency matter?

Knowing where customer information is hosted gives an organisation greater clarity about where its data is being processed and stored. For UK organisations, UK hosting can also form part of their own compliance, procurement and contractual considerations.

What should I ask a supplier about AI security?

Start by asking what the AI can access and what it can do. Can it browse the internet, access databases, execute code, send emails, modify files or connect to external systems? You should also understand where the AI gets its information and whether integrations require explicit permission before they can be used.

Is ISO 27001 enough to guarantee that a supplier is secure?

No certification can provide an absolute guarantee of security. ISO 27001 is valuable because it demonstrates that an organisation has a structured information security management system, but security needs to be maintained through ongoing assessment, monitoring, testing and improvement.

What security controls does Click4Assistance provide?

Click4Assistance operates an ISO 27001:2022 certified platform hosted in the UK and supports a range of security controls, including role-based permissions, audit logs, SSO and MFA. Regular penetration testing is also part of the wider approach to maintaining and testing the security of the platform.