Security

The public site key is designed to ship in your frontend. It is not a visitor authorization token.

Allowed-domain locking restricts widget API use to hostnames you list. An empty list means unrestricted until you add domains.

Integration credentials are encrypted at rest with AES-GCM. Secrets are never returned by the API after creation.

Server-side secrets live in Cloudflare Workers secrets, not client bundles.

Outbound webhooks are signed with HMAC-SHA256 over timestamp and raw JSON body.

Rate limits apply to public widget and dashboard APIs. Message HTML is stored and rendered as text, never as markup.

Each workspace can only access its own conversations. Visitor tokens are hashed; raw tokens are shown once.

We do not claim SOC 2, ISO, or other certifications we do not hold.