Account access and business boundaries
Business data is handled through the application workspace and tenant context. Your team should grant access according to responsibilities and review who can see enquiries. Keep passwords private and remove access that is no longer needed. A shared team process is easier to audit than several people using one account.
The public widget establishes its business context from its identifier and approved origin. Exact hostnames are checked rather than treating an arbitrary website as authorised. Widget session tokens and usage checks protect the public conversation route, but they do not replace monitoring or careful deployment.
Public identifiers and private secrets
The embed needs the widget script URL and public widget ID. Provider API keys and webhook signing secrets should not appear in website source, screenshots, or public enquiries. Keep secrets in server-side configuration. Rotate a credential through its provider if it has been exposed.
Webhook delivery uses a timestamp and HMAC signature. A receiver needs to verify the signature and check replay and duplicate handling. The application signing option is not a substitute for secure code in the destination system.
Information sent for AI answers
Relevant knowledge and recent conversation messages are supplied to the configured AI provider to generate replies. The current provider integration is DeepSeek. Do not upload sensitive documents or customer information you are not authorised to process. Review provider terms and hosting decisions for your use case.
The assistant is instructed to answer from supplied facts and refuse to invent commitments, but prompts cannot guarantee correct output or prevent every unsafe response. Test questions, review important answers, and keep a human route for decisions requiring judgement.
Analytics and deployment responsibilities
Optional visitor analytics respects consent and supported browser privacy signals. It does not retain raw IP addresses or exact GPS coordinates. Approximate geography depends on trusted location input; otherwise records remain Unknown. Conversation and CRM retention have separate purposes.
HTTPS, backups, access to hosting, incident response, and production monitoring remain operator responsibilities. No SOC 2, ISO 27001, data residency, penetration-test result, or published security SLA is claimed here. Ask the provider about the deployment evidence you require before sending regulated information.