Skip to content
FluentChat FluentChat Beta
This site is under construction. Content, screenshots, and workflows may change at any time.

Security Practices

FluentChat is designed to protect the data customers use to build bots and the data visitors share while using them. This page summarizes the technical and organizational safeguards described in our Privacy Policy and Data Processing Addendum.

Application security

  • HTTPS by default — all FluentChat traffic is served over HTTPS.
  • Protected passwords — passwords are hashed with bcrypt. FluentChat does not store their plain-text value.
  • Verified widget identities — when a customer enables Identity Verification, FluentChat verifies the visitor identity with an HMAC-signed payload generated on the customer’s server.
  • Authenticated webhooks — incoming webhooks use shared secrets and are verified before they are processed.
  • Scoped access — access to customer data is limited to authorized people and providers with a need to know, using authentication, permissions, and logging controls.

Data protection

Customer Content can include knowledge sources, prompts, chat messages, attachments, and bot configuration. FluentChat uses safeguards appropriate to that processing:

  • Data is encrypted in transit and at rest.
  • Backups are encrypted and retained on a rolling schedule.
  • Attachments and knowledge-base sources stored in Cloudflare R2 are delivered through short-lived signed URLs.
  • Secrets are managed through deployment environments and injected at deploy time; they are not stored in the application image.
  • Error reports sent to Sentry pass through a filter that removes known PII fields before transmission.

AI processing

FluentChat sends the portions of Customer Content needed to answer a request — including prompts, retrieved passages, and messages — to the AI providers listed in our Privacy Policy. This processing is performed to provide the service on the customer’s instructions.

We do not train FluentChat models on Customer Content, and we do not permit our AI subprocessors to train their models on it.

Retention and deletion

Customers can delete their team and its associated data through the service. FluentChat begins deletion within 30 days, except where retention is required by law, such as billing records. Encrypted backup copies may remain until their normal rotation or expiry.

For visitor data supplied by a FluentChat customer, that customer is ordinarily the controller and FluentChat acts as its processor. Read the Privacy Policy for data categories and retention details, and the DPA for the data-processing terms.

Your responsibilities

Security is shared. Customers should:

  • Keep account credentials, API tokens, webhook secrets, and identity-verification secrets private.
  • Generate identity signatures on a trusted server, never in browser-side code.
  • Set appropriate team roles and permissions.
  • Give visitors the privacy and cookie notices required for the customer’s own website and widget use.
  • Avoid placing unnecessary sensitive data in bot prompts, knowledge sources, or chat messages.

Report a security issue

If you believe you have found a security issue in FluentChat, email contact@fluentchat.ai with the subject Security report. Please include enough detail to reproduce the issue, avoid accessing or modifying other customers’ data, and do not send passwords, API tokens, or other secrets in the report.

For privacy requests, subprocessors, and data-processing questions, see the Privacy Policy or contact us at the same address.