Security and privacy
What this puts on your site, and what it does with what it sees.
Embedding somebody else's script is a real decision, and "trust us" is not an answer. This page is the set of things a cautious buyer asks before doing it. Where the honest answer is a limitation, it says so.
The widget is open source
This is the strongest answer we have to "what is that third-party script doing on my site", so it goes first. The widget's code is public and readable: you can audit exactly what runs in your visitors' browsers, and you can restyle it against a documented token and slot contract rather than by fighting it.
The server is not open source, and there is no self-hosting option. Better said here than discovered after a procurement conversation.
What the bot can and cannot do
- It reads, it does not act. The bot answers from your material. It cannot place an order, change a booking, or take any action on a visitor's behalf.
- Connected APIs are read-only. When it calls an endpoint of yours during an answer, it is fetching, never writing.
- It does not write its own links. Citations are built by the server from what was actually retrieved, so the model cannot invent a plausible URL and put your name on it.
- It does not start conversations. The only unprompted thing a visitor sees is the greeting you configured.
Tenant isolation
Every row that belongs to a workspace carries its workspace, and the database enforces that on every query rather than trusting the application to remember - including for our own maintenance roles. A query with no workspace context returns nothing at all, which is a loud failure rather than a quiet leak.
The two embed modes
Floating launcher
Runs inside an iframe served by Ask, with the list of sites allowed to frame it built from your verified domains. Your page's scripts cannot read the conversation, and the widget's cannot read your page.
Inline panel
Mounted directly in your page, so it inherits your layout. In exchange it takes no identity hints and shows no visitor-visible history, because in this mode the surrounding page could reach them. That refusal is enforced on the server, not just hidden in the interface.
Domain ownership
A widget answers only on domains you have verified, by a DNS record or a file we fetch from the site. Until a domain is verified, the widget will not answer there and outbound email for that workspace does not send - which is also how a stolen widget key stops being worth stealing.
The AI notice ships switched on
Every conversation tells the visitor they are talking to an AI. You can word it yourself and translate it; you cannot remove it, on any plan, including the paid ones that remove our badge. The server sends it with the conversation, so a customised widget cannot drop it either.
Retention, export and deletion
- Retention is yours to set. Transcripts expire on the schedule you choose. Cases can outlive the transcripts they came from, which is deliberate: the case is your record of what went wrong, and it does not need the visitor's words to stay useful.
- Deletion reaches the derived data. Deleting a visitor removes the transcripts, the cases, the captured contact fields, the embeddings, the summaries and the audit arguments - through the provenance chain, not just the obvious tables. The record of what was charged survives with the attribution stripped, because we are not going to make the invoice disagree with itself.
- Export is one job away. Everything your workspace holds, downloadable as a file.
- Deleting a workspace is irreversible, and the screen says so before you do it.
One embed cannot run up a bill
There is no overage. When the included usage is gone the bot stops answering, tells the visitor it cannot answer right now, and still records their question as a case. Warnings arrive at 80% and 95%, there is a daily spend cap on top of the monthly allowance, and per-widget rate limits sit in front of all of it. A top-up restores service immediately.
Where answers are produced
Answers are produced by third-party model providers, reached through an aggregation service that selects a provider per request. That means the set of providers an answer might reach is a list rather than a single name, and the list is what we publish: the sub-processor annex names every one, with its purpose and its location, dated and versioned.
Two claims you will not find anywhere in this product today, because neither is verified end to end: a regional guarantee about where an answer is produced, and a guarantee about what a provider does with what it receives. Pinned regional processing is being built. Until that route is running and checked, the claim stays off this page, off the pricing page, out of the plan comparison, out of the terms and out of the WordPress plugin. When it ships, this section gains a positive statement and the annex gains a row.
Reporting something
Security and privacy enquiries have their own route on the contact page, and they do not go through the sales queue.