How intoCHAT handles
your data.
What we do to protect your agent's knowledge, conversations and leads, and what stays in your control.
Sent over HTTPS
The chat widget, the dashboard and the agent talk to intoCHAT over HTTPS, so data is encrypted on its way between the browser and our servers.
Each agent keeps its own knowledge
An agent only searches the knowledge you gave it. Your content isn't shared with other agents or other customers.
Grounded answers
Built-in rules treat your content as reference material, never as instructions, which helps the agent resist prompt injection. When nothing relevant is found, it says it doesn't know instead of guessing.
You stay in control
You decide what each agent learns from. Visitors share contact details only if they choose to, temporary chats aren't saved, and you can delete conversations and leads at any time.
Rate limits
Chat requests are rate-limited per visitor and per agent to keep out abuse. You can also limit an agent to your own domains, keep it private, block countries, cap messages per visitor per hour and set a monthly reply cap per agent.
Protected sign-in and verified visitors
Turn on two-factor authentication to protect your email-and-password sign-in with a code from an authenticator app, with single-use recovery codes as a backup. Signing in with Google relies on your Google account's own security. On your website, identity verification lets your server sign each signed-in user's id, so nobody can pose as another user, and you can let only verified visitors chat.
Good to know
intoCHAT holds no security or data protection certification such as SOC 2 or ISO 27001. Embeddings are created with an OpenAI model and answers with your agent's model, so visitor messages and relevant passages of your content are sent to OpenAI, and also to Anthropic or Google if you choose one of their models.