Security

Keeping your chats and your visitors’ details safe is part of the product. This page explains how we protect data in LiveChatBot.

1. Encryption in transit

The dashboard, the chat widget, the API and the phone app all use HTTPS (TLS), so data between browsers and our servers can’t be read on the way.

2. Accounts and access

• Passwords are hashed with bcrypt. We can’t see them.
• Sign-in attempts are rate-limited to slow down password guessing.
• Every request is checked against the account it belongs to, so one customer can never see another customer’s data.
• Account owners decide who is on their team and can remove teammates at any time.
• Our own staff area sits at a private address and needs an authenticator-app code in addition to a password.

3. Protecting stored data

• API keys are stored as SHA-256 hashes and shown only once, when created.
• Secrets such as plugin tokens and two-factor keys are encrypted in the database.
• Card details never touch our servers: payments are handled by Razorpay.
• The widget never sends what visitors type into your website’s own forms: only the names of fields they filled.
• Visitor locations are looked up on our own server, so IP addresses aren’t sent to a location service.

4. The chat widget

• The widget runs inside a Shadow DOM, separate from your page’s code and styles.
• You can lock a widget to your own domain (Website settings), so it can’t be used on other sites.
• Messages and requests from the widget are rate-limited to stop spam, and you can block abusive visitors and their IP address.

5. AI

The AI Agent is off until you turn it on. Without an AI provider it runs entirely on our own servers, matching questions against that website’s knowledge base. When Advanced AI mode is on, chat text and that website’s knowledge base are sent to the AI provider we use (Anthropic, OpenAI or OpenRouter) to write replies. Their API terms say API data isn’t used to train their models by default.

6. Reporting a vulnerability

If you find a security issue, please email support@livechatbot.in with the subject “Security” and steps to reproduce it. Please give us reasonable time to fix it before telling others, and don’t access or change other people’s data while testing. We reply as fast as we can and credit you if you’d like.

See also: Privacy Policy · Data Processing Addendum · Sub-processors