Trust and security

Security is a property of mechanisms, not of intentions — so what follows is the specific machinery protecting your data, described precisely enough for your engineers to check rather than take on faith. Every control here is running in production, and each was re-verified against the live system on 8 August 2026.

These are legal frameworks we comply with directly, and each one below states what makes that true so you can check it rather than take the label's word for it.

• 

  GDPR compliant

  Every sub-processor named on this page, a data processing agreement available on request, a stated retention window enforced by a scheduled job, and export or deletion of a person's data on request.

• 

  CCPA / CPRA compliant

  We do not sell or share personal information, and we process it only to run the service you bought. Access and deletion requests reach the same address as everything else here.

• 

  EU AI Act aligned

  Transparency obligations for a system like this one: answers cite the passages they were drawn from, the assistant refuses rather than guesses when your content does not cover a question, and a visitor can always ask to reach a person.

For a signed data processing agreement or a completed security questionnaire, write to [email protected] and it will come back filled in rather than deflected.

The key embedded in your website's HTML is public by necessity — anyone can read it in the page source. It is therefore not a credential, and on its own it opens nothing.

• Every widget API request carries a signed, short-lived session token. There is one place tokens are issued and one place they are checked, so a route cannot be added that forgets to.
• Issuing a token requires the request to come from a domain on your allow-list, and to pass an attestation step — a proof-of-work puzzle, and Cloudflare Turnstile, which is live in production. Both exist to make automated abuse expensive rather than to inconvenience a visitor.
• Tokens are bound to one bot and to the origin they were minted for, and expire after thirty minutes.
• A conversation id is an identifier, not a password. Reading or continuing a conversation additionally requires a signed capability scoped to that conversation and that bot, so guessing an id gets you nothing.

Spend is bounded at four levels independently: per session, per IP address, per bot per day, and per account per month. A visitor cannot run up your bill, and neither can a script pretending to be one.

If your assistant should answer differently for a signed-in customer, it needs to know that the visitor is who they say they are. A claim made by the browser cannot establish that, because the browser is the thing under the visitor's control.

So identity is proved by your backend: it signs the user id with a secret only you and we hold, and we verify that signature before treating the visitor as that person. An unsigned or invalid claim is not an error — it is simply anonymous. The failure mode is a visitor who gets less, never one who gets someone else's data.

Embedding our widget means running our JavaScript on your domain. That is a real thing to ask of you, and it deserves more than a promise to be careful.

• The widget ships as immutable, content-addressed bundles: a given URL always returns exactly the same bytes, because the URL is derived from them.
• The install snippet carries a Subresource Integrity hash. If the file served ever differs from the file you approved — by compromise, by mistake, or by anything in between — your visitors' browsers refuse to execute it rather than running it and telling nobody.

• Every table denies all access by default. There is no permissive policy to misconfigure: the only path to data is server-side code holding a service credential that never reaches a browser.
• Every query is scoped to one account. Isolation is a property of the access path, not a filter a page is trusted to remember.
• Data is encrypted in transit and at rest.
• Conversations are deleted on the retention window you choose. Attachments are deleted on a fixed window per plan whether or not you set one, because files are the only store here that grows without a ceiling. A scheduled job performs both — it is not a manual chore we might forget.

Deleting a bot deletes its conversations, its captured contacts and its uploads. Closing your account deletes the workspace and everything under it. The full detail, including the exact windows, is in the privacy policy.

The same list the privacy policy publishes, from the same source — there is one definition of this in the codebase, so the two pages cannot drift apart. Regions are the ones actually provisioned, not each vendor's head office.

Services marked optional are engaged only if you connect them yourself. If you never link a Slack workspace, nothing reaches Slack.

If you believe you have found a vulnerability, write to [email protected] with enough detail to reproduce it. You will get three things: confirmation that it arrived, what we found when we looked, and the date it was fixed — from someone who can act on all three rather than a queue.

For a data processing agreement, a completed security questionnaire, or a question this page does not answer, the same address reaches us.