Security overview

Configurable security features

Feature	Description
Role-based access (RBAC)	Restricts dashboard access to authorized users with segmented permissions.
Domain restrictions	Limits which domains can embed the assistant widget.
Rate limiting	Per-session and per-IP limits to prevent spam and abuse.
PII removal	Automatically detects and redacts names, emails, and phone numbers from conversations.
API key authentication	Enable Require authentication for all API access under Settings > Security & Privacy > Access Control to make a project private. Send keys as Authorization: Api-Key <token>.
Granular API permissions	Scope each API key to the operations it needs, such as projects_read, search, chats_create, and sources_create in API v2. Legacy names remain valid aliases.
Project-scoped API keys	Limit a key to a single project when you create it, so it can't reach your other projects or read the team.

Data protection

Layer	Protection
Network	Firewalls, DDoS mitigation, continuous monitoring, and real-time alerts.
Data encryption	Encrypted in transit and at rest. Automated backups for recovery.
Audit logs	Detailed logs of security-sensitive operations for accountability.
Account isolation	Customer data is strictly separated between accounts.
No model training	Customer content and end-user conversations are not used to train third-party AI models.
GDPR support	A DPA, data controls, and EU data residency options support customer compliance requirements.

See the Privacy Policy for details on data handling.