Security and privacy
How SiteTrellis isolates tenants, encrypts keys and secrets, what visitor data is stored, how to delete data, and where to find our legal pages.
Last updated:
You are trusting SiteTrellis with your AI provider keys and your customers' conversations. This page explains in plain language how we protect them, what data is stored, and what you can do to delete it. It is a technical overview, not a legal document: the binding terms are in our legal pages.
Tenant isolation#
Every customer account is a separate tenant. All data that belongs to a tenant is stored with the account's identifier, and every database query that touches it filters on that identifier, together with workspace and site checks where relevant. Dashboard users can only reach data in their own account, and within the account only the workspaces they have access to. The visitor API uses signed tokens that bind a visitor to exactly one conversation, so a token cannot be used to read another conversation. Automated tests check that a second tenant cannot read or change the first tenant's data.
Keys and secrets#
- AI provider keys, agent tool secrets and webhook signing secrets are encrypted at rest with libsodium (
secretbox) using a master key that is kept outside the database. Rotating the master key is supported. - After you save a secret only a short hint is displayed. Full secrets are never returned to your browser, never written to logs, and never included in the widget configuration.
- Passwords are stored as salted one-way hashes (Argon2id where available).
- Traffic between visitors, the dashboard and the API is encrypted with HTTPS. Calls to AI providers and your tool endpoints also use HTTPS.
- The master key and other server secrets live in server configuration, not in the code repository.
What visitor data is stored#
| Data | Why | Notes |
|---|---|---|
| Messages (visitor, AI, operator) | To show the conversation, and to give the AI context. | Stored in full until deleted. Visitors can request a transcript by email. |
| A visitor id and session token | To keep a conversation across pages. | The widget keeps the token in the browser's storage if "persist session" is on. |
| Page URL and page title | Context for the agent and for you. | Taken when the chat starts. |
| Attributes (name, email, custom) | From the pre-chat form, lead forms, the JavaScript API or the AI. | Only what you collect or pass. They may be sent to the AI provider as part of the prompt. |
| Network details | Abuse protection and rate limits. | The browser's user agent is stored; the IP address is stored as a one-way hash rather than in readable form. |
| Leads and ratings | The lead list and quality feedback. | Deleted with the conversation or on request. |
| Technical traces | Debugging and analytics: provider, model, status, latency, token counts and estimated cost per request; tool calls. | Contains tool argument excerpts, so avoid sending secrets through tool arguments. |
SiteTrellis does not sell visitor data. Because it does not run its own AI models, your conversations are not used to train any SiteTrellis model; what your AI provider does with them is governed by your agreement with that provider. The widget stores only what it needs to run the chat.
What goes to AI providers#
To produce a reply, SiteTrellis sends to your chosen provider: your system prompt, knowledge text, tool definitions, the recent part of the conversation (up to the history window), page context and visitor attributes used in the prompt. Each provider has its own retention and training terms, which you accept when you create the key. See the provider guides (Anthropic, OpenAI, Gemini, OpenRouter, DeepSeek) and tell your visitors about this in your privacy policy. Do not put into your prompt, knowledge or tool responses any data you would not want a provider to receive.
Safety measures in the chat itself#
- Visitor text, knowledge and tool results are placed in clearly labeled blocks and the model is told they are data rather than instructions. See the prompt writing guide for how to reinforce this and its limits.
- Custom HTTP tools block requests to private, loopback and link-local network addresses, do not follow redirects, and cap response size and time. See Custom HTTP tools.
- The widget runs in a Shadow DOM and only talks to your site's allowed origins. Visitor input is rate limited and length limited.
- Visitors see friendly generic errors; technical detail is recorded for you in the dashboard.
Retention and deletion#
Password recovery signs out the user's dashboard sessions and revokes their connected assistants, API keys and apps across their accounts. Other team members keep their connections. Changing the account email also invalidates password-reset links sent to the previous address.
SiteTrellis keeps conversation history for the period your plan allows: 30 days on Free, 12 months on Starter, 24 months on Pro and 36 months on Agency. A daily job then removes older conversations and their messages; leads you captured are kept. You can delete data sooner at any time, and you should make sure the period fits your policy and local law.
- Individual items: delete a conversation or lead from the dashboard to remove it and its messages. Deleting a site or agent removes the data tied to it.
- A visitor's request to erase their data: find their conversations in the dashboard (search by the email or name you collected) and delete them. Contact us if you need help.
- Webhook delivery logs are removed automatically after 30 days.
- Deleting your account (Owner only, under Settings) needs you to type the account name and your password. The account is closed immediately for everyone, any active subscription is cancelled, and a background job then permanently removes all tenant data (sites, agents, conversations, leads, provider keys, secrets, webhooks, team memberships and the audit log). People who belong to no other account lose their login. Deleted data cannot be recovered. Database backups may retain copies for a limited period before they expire.
- Retention follows your plan, and there is no self-service export of full conversation history. Export leads as CSV, and contact support for a full export.
GDPR and compliance pointers#
If you serve visitors in the EU, UK or similar regimes, these are the practical points. This is general information, not legal advice.
- Roles. You are normally the controller of your visitors' data and SiteTrellis acts as your processor. A Data Processing Agreement describes this; ours is a draft, see the DPA.
- Transparency. Tell visitors that they are chatting with an AI, that conversations are stored, and which providers receive the text. The widget's consent text option and pre-chat form can carry this notice. See Widget customization.
- Lawful basis and consent. Decide your basis (often legitimate interest for support; consent for marketing). If you need consent first, load the widget only after consent; see Install with Google Tag Manager.
- Data minimisation. Collect only needed fields. Do not ask the agent to collect payment card numbers, passwords or health information. Add that rule to the prompt and to blocked topics.
- International transfers. Your AI provider and SiteTrellis' hosting may be outside your region. Check the provider's data location, and see the note on DeepSeek in Connect DeepSeek.
- Rights requests. Access, rectification and erasure requests are handled by finding and exporting or deleting the conversations as described above.
Reporting a security issue#
If you believe you have found a vulnerability, please contact us with details and give us reasonable time to fix it before disclosing. Do not access other customers' data.