The widget
Your widget key works only on the website addresses you set, so someone who copies your snippet to another domain cannot use your account's chat. Chats are tied to a session so a visitor cannot read another visitor's conversation. The widget loader checks the integrity of the script it loads.
Sign-in and accounts
You can turn on two-factor authentication for the portal. Password reset links are single-use, expire quickly and are tied to the browser that asked. Team members get only the access you give them, per website, and changes are recorded.
Data in transit and at rest
All traffic uses HTTPS. Keys you store, such as the key for a business action, are stored encrypted and never shown again or sent to visitors. Backups are encrypted.
What the AI can and cannot reach
Business actions only read, call only public addresses over HTTPS, have time limits and never expose the raw response to the model. The assistant answers only from your information and the fields you choose.
Your data, your control
You can export your chats, leads and knowledge, ask the chat to forget a visitor, delete a person from Contacts and delete a website with its data. See the privacy policy and the data processing addendum.
Reporting a problem
If you find a security issue, write to security@chatdek.com with the details. We read every report. A security.txt file is published for researchers.