Security and data

Where is my data stored, and can another customer see it?

In PostgreSQL, with every row carrying its tenant. Isolation is enforced by the database through row-level security, and the application connects with a role that cannot bypass it. That distinction matters: a query that forgets to filter by tenant returns zero rows rather than someone else's data. The guarantee does not depend on application code being written correctly every time.

How are my credentials stored?

Webhook secrets, CRM tokens, Telegram tokens, SMTP credentials and Google Drive refresh tokens are encrypted with AES-256-GCM, and the encryption key is not kept in the database. A stolen database dump is not a stolen set of integrations.

Can the crawler be pointed at internal systems?

No. Both crawling and agentic actions resolve the target address and reject private ranges and cloud metadata endpoints, and every redirect is checked rather than followed blindly — a public URL that redirects inward does not get through.

Can a poisoned web page or a visitor take over the bot?

Page content and visitor messages are handed to the model as untrusted data. Text cannot invoke an action. Only the actions you explicitly enabled exist at all; their parameters are validated against a schema, write actions require approval, and every call is written to the audit log.

What happens to files a visitor uploads?

They are never stored. An attachment exists for the duration of one request and is discarded — it is not added to your knowledge base, and it creates no new retention obligation. The honest consequence: a colleague who takes the conversation over cannot see the file, because it does not exist any more. File type is determined from the content itself, not the filename, so a renamed executable does not pass.

Attachments and voice input are off by default and enforced on the server, not merely hidden in the widget — so a request that skips the widget cannot run up a bill on a feature you disabled.

Who else processes my data?

The full list, with what each one handles and where it sits, is on the subprocessors page. Google Drive and Telegram appear there too, and apply only if you connect them — they are named even though they charge nothing, because the test is whether they touch your data, not whether they invoice for it.

See also the data processing agreement and privacy policy.