Security

All traffic between your visitors, the chat widget, and our API runs over TLS 1.3. Your content and conversation data are encrypted at rest.

Your knowledge base is private and isolated to your organisation. The content you train on is never shared with other customers and is never used to train a shared or third-party model. Chatbot answers are generated only from the content in your own knowledge base.

Session tokens are stored as SHA-256 hashes, never in plaintext — a leaked database row cannot be replayed as a valid session. Team access is role-based: owner, admin, and member roles separate billing, bot management, and read-only access.

You can restrict a chatbot widget to specific domains, so nobody else can embed your bot on their own site. Per-visitor rate limiting is applied automatically to keep spam and abuse from consuming your message quota.

After a cancellation, data is removed on a documented schedule rather than being held indefinitely:

• Vector embeddings (training data): deleted 30 days after cancellation
• Conversation history and messages: deleted 60 days after cancellation
• Chatbot configuration and leads: deleted 90 days after cancellation

You receive an email warning 7 days before each deletion phase. You can request an export or immediate deletion of your data at any time — see the privacy policy for how.

We do not collect or store payment card details. Payments are handled directly by our payment provider, Dodo Payments.

If you believe you have found a security issue, email support@ontroz.com with the details and steps to reproduce. We will acknowledge your report and keep you updated as we investigate. Please give us a reasonable opportunity to address the issue before disclosing it publicly.