PII redaction, by default
Emails, phone numbers, national IDs, and card numbers typed into chat are masked before they’re stored. On every tier.
- [EMAIL]
- [PHONE]
- [NATIONAL_ID]
- [CARD]
Product Security & trust
Your content, in one place.Your visitors’ data, private.
Exactly how OptoBot stores, protects, and deletes data, stated plainly, including what we haven’t built yet.
What the visitor types
Hi, I’m Amira. Call me on 0100 555 0142 or email [email protected]
What OptoBot stores
Hi, I’m Amira. Call me on [phone] or email [email]
On by default, on every tier. Sample values, nothing is sent.
One database.Not a sprawl of vendors.
OptoBot keeps your content, conversations, and leads in its own database and searches your content in place, with PII redaction applied before anything is stored.
- Your documents, search index, conversations, and leads live in OptoBot’s own database.
- No third-party search service. Your content is searched where it is stored.
- Answers are drafted by the model your project selects: OpenAI, Mistral, or Gemini.
OptoBot database
- Documents
- Search index
- Conversations
- Leads
Searched in place
Third-party search service
A second copy of your content
Protections on your accountand your transcripts.
Automatic retention
Paying organizations’ data is never purged; dormant free-tier projects are anonymized after 5 years of inactivity.
Audit log
A record of administrative actions, included from the BUSINESS plan.
Two-factor and Google sign-in
Opt-in authenticator-app 2FA with recovery codes and lockout, or sign in with Google.
Audience-scoped tokens
A token minted for one job can’t be replayed for another.
PII redaction is a platform default on every tier. The audit log is surfaced from BUSINESS.
The widget and the WhatsApp lineare hardened.
Your widget
- Rotatable embed keys: issue a fresh key whenever you need one.
- Short-lived embed tokens, not long-lived secrets.
- Origin allowlist + frame-ancestors CSP: only origins you approve.
- Per-project daily message caps: abuse can’t run up your usage.
Your WhatsApp number
- Signature-verified webhooks: every inbound Meta event is verified first.
- Credentials encrypted at rest with AES-256-GCM.
- Redelivery dedup: Meta’s retries can’t double-answer a visitor.
We crawl what you own.We cite what we used.
Trust runs in both directions: into the knowledge base, and out of every answer.
Ownership check first A DNS TXT record or a hosted file challenge. No crawls of domains you can’t prove.
Every answer cites its source So your team, and your customers, can verify the claim. Source · Returns policy
No certificationtheater.
We won’t dress the product up with badges it doesn’t have. Here’s the ledger.
Built in
- PII redaction, automatic retention, and audit logging
- TOTP 2FA with recovery codes and lockout
- Google sign-in
- AES-256-GCM-encrypted WhatsApp credentials
- Hardened embeds: rotatable keys, short-lived tokens, origin allowlists, daily caps
Not claimed
- Compliance certifications. We hold none and claim none.
- Badges, audit reports, or borrowed trust
- Anything on the roadmap below
The privacy policy spells out what we process and why. Read it
On the roadmap, not available today
- Planned SSO / SAML One login for your whole team through your identity provider.
- Planned In-region data residency Hosting in KSA, the UAE, or Egypt for regional requirements.
- Planned Self-hosting Run OptoBot on your own infrastructure.
Ask us where they stand. The answer changes, and this page will change with it. Talk to us about Enterprise
Questions we getfrom IT reviewers.
Plain answers about how OptoBot works. If yours isn’t here, ask the people who build it.
Where is my data stored?
In OptoBot's own database. Your documents, search index, conversations, and leads stay in that one store, and PII is redacted before anything is stored. No external search service holds a copy.
How long is chat data kept?
Retention is a built-in policy, not a setting you have to negotiate: active projects and paying organizations' data is never purged, and dormant free-tier projects are anonymized after 5 years of inactivity. Personal information is redacted from stored transcripts either way.
Is the WhatsApp connection secure?
Inbound Meta events are signature-verified before processing, your connection credentials are AES-256-GCM encrypted at rest, and duplicate webhook redeliveries can't answer twice.
Can someone embed my widget on their site?
Only on origins you allowlist. The widget uses short-lived embed tokens scoped to your project, its frame-ancestors CSP restricts embedding, and you can rotate the embed key at any time.
Do you have security certifications?
No — and we won't claim any. What's built in: PII redaction, automatic retention, audit logging (from BUSINESS), 2FA, and hardened embeds. This page and the privacy policy describe exactly that.
What about SSO or hosting in my region?
On the roadmap, not shipped. See "On the roadmap" above — or book a demo and ask us directly.
Let’s build a better conversation.
We showed the mechanisms. Start free, or bring this page to a demo and quiz us.