A chatbot is a script on every page of your website, connected to a service that stores your content and your visitors' messages. That is not alarming, but it earns the same scrutiny as any other vendor.
Eight questions, and what a good answer sounds like.
1. Where is our data stored, and for how long?
Good answer: a named region, a stated retention period, and a way for you to shorten it. Bad answer: "securely in the cloud".
2. Can we delete everything, and what happens if we cancel?
Good answer: a clear deletion path and a stated position on what happens to conversation history after cancellation.
3. What certifications do you actually hold?
Ask for evidence. SOC 2 and ISO 27001 are audited certifications, not adjectives, and a vendor that holds one can produce the report.
A vendor claiming a certification they do not hold has told you something important about everything else they claim. This is worth checking rather than assuming — it is one of the most commonly overstated items on a marketing site.
4. Is our data used to train models?
Good answer: a plain no, or a clear explanation with an opt-out. This matters if visitors may type anything sensitive.
5. Can we restrict which domains the widget runs on?
An embed code with a bot id can, without a domain allowlist, be pasted onto any site. A good product lets you restrict it.
6. How is tenant data isolated?
You want confidence that another customer cannot see your content or conversations. Ask how it is enforced, and whether it is tested.
7. What happens to personal data visitors type in?
People will paste things they should not. Ask what controls exist and whether you can configure the bot to avoid collecting particular categories.
8. Will you sign a DPA?
If you are subject to GDPR and visitors can enter personal data, expect a data processing agreement to be available.
Our own answers, for the record
Traffic is encrypted in transit. Stored credentials, including per-account API keys, are encrypted at rest with AES-256-GCM. Data is isolated per account, and a per-bot domain allowlist restricts where the widget will run. Visitor analytics honours Do Not Track and Global Privacy Control, raw IP addresses are erased after 90 days, and conversation retention windows are configurable per account.
We do not currently hold SOC 2 or ISO 27001 certification, and we would rather say so than let you discover it during procurement.
Related: our privacy policy.