Secure Account and Workspace Access
Every PluginChatBot account and workspace is kept separate. Users can only access information tied to their own organisation.
- Authentication, user permissions, and workspace-level access controls protect sensitive areas
- Important account actions are validated on the backend to block unauthorised access
- Email verification and password recovery add extra protection
This follows security best practices like least-privilege access and strong authentication.
Sensitive Credentials Are Encrypted
Some integrations need sensitive details like API keys or OAuth tokens. PluginChatBot encrypts these credentials before storing them, never as plain text.
- Encrypted credentials are decrypted by the backend only when needed
- This keeps private integration credentials away from website visitors and browser code
Encrypting data at rest and in transit is a core recommendation for secure AI chatbots.
Chatbot Access Can Be Restricted to Approved Websites
You decide exactly which website domains your chatbot can run on.
- If someone copies your embed code to another site, PluginChatBot checks it against your domain rules
- This prevents unauthorised use of your configuration
Domain whitelisting is a practical way to reduce misuse of chatbot embeds.
Business Data Stays Connected to the Right Workspace
Chatbot settings, conversations, leads, knowledge sources, and usage data remain linked to the correct customer account and workspace.
- Access checks happen on the backend, not just in the browser
- This matters because browser requests can be inspected or modified
Server-side validation and data separation are standard privacy-by-design practices.
Businesses Control Their Knowledge Base
You choose what information your chatbot can use when answering visitors.
- Add knowledge from supported documents and website pages
- Update or remove sources when information changes
- Upload only content you’re authorised to use and that’s appropriate for customers
This ensures your chatbot only shares accurate, approved information. See how to train your chatbot using website FAQs and documents for guidance on what to upload.
Customer Conversations and Lead Information
PluginChatBot can store website conversations so you can review enquiries and improve support.
- When lead capture is enabled, the chatbot may collect visitor details (name, email, phone, etc.)
- You can use this information to respond and follow up with potential customers
- Lead capture is configurable, you decide what’s necessary for your use case
Collecting only what you need is a key privacy principle for chatbots.
Important: Clearly explain to visitors what information is being collected and how it will be used.
AI Requests Are Processed Through the Backend
PluginChatBot processes chatbot requests through its backend, not in the website widget.
- The embedded chatbot sends the visitor’s request to PluginChatBot
- The backend communicates with the configured AI service
- This prevents API keys and sensitive credentials from appearing in browser code
When an external AI provider is used, information may be processed under that provider’s terms and privacy practices.
Controls Help Protect Against Abuse
Unexpected traffic and automated misuse can affect accounts and platform availability. PluginChatBot includes usage controls to reduce these risks.
Depending on your setup, protections may include:
- Rate limits
- Message allowances
- Usage monitoring
- Request validation
- Integration verification
- Webhook security checks
These controls help prevent excessive activity and protect against unauthorised requests.
Data Collection Depends on the Features You Use
Not every chatbot needs to collect the same information.
- A chatbot that only answers common questions may not need visitor contact details
- A sales-focused chatbot may need lead capture to follow up on enquiries
- PluginChatBot lets you choose features that fit your needs
This supports data minimisation and purpose-limited collection, which are central to privacy compliance.
Privacy Is a Shared Responsibility
PluginChatBot provides technical controls to help protect data, but businesses also play an important role.
Businesses should:
- Provide the chatbot only with appropriate and authorised information
- Limit access to team members who need it
- Keep account credentials secure
- Review chatbot knowledge and integrations regularly
- Collect only the visitor information needed for a clear purpose
- Provide appropriate privacy notices to website visitors
- Review the terms and privacy practices of connected AI and integration providers
These steps help you use the platform responsibly and maintain control over your data.
Security Is Built Into the Product
Data protection isn’t optional in PluginChatBot. It’s supported through multiple layers:
- Authenticated access
- Encrypted credentials
- Workspace isolation
- Approved-domain controls
- Backend API handling
- Configurable lead capture
- Abuse-prevention measures
The goal is simple: help businesses use AI chatbots confidently while maintaining control over their chatbot, business information, and customer data.