Security and privacy
What SiteMesh does to protect your data, and what remains your responsibility.
Your account
Passwords are hashed with bcrypt before storage. Nobody — including SiteMesh staff — can read your password. If you forget it, it is reset, not recovered.
Sessions use short-lived access tokens paired with rotating refresh tokens, both stored in httpOnly cookies. httpOnly means JavaScript running in the page cannot read them, which removes the most common route to session theft. Refresh tokens are stored server-side by hash rather than in the clear.
In production, cookies are marked secure, so they are only ever sent over HTTPS.
Your part: use a strong, unique password. Session security cannot help if the password is reused from a site that has been breached.
Your widget keys
The key in your website's source is a deliberately public, deliberately limited credential:
| It can | It cannot |
|---|---|
| Send messages to the one chatbot it belongs to | Reach any of your other chatbots |
| Work from the domains you allowed | Work from any other domain |
| Read that chatbot's public widget configuration | Access your dashboard or account |
| Read your leads, transcripts or training content | |
| Change any setting |
It is rate-limited and revocable at any moment. The worst case if it leaks is someone trying to run your chatbot on their own site — which the domain restriction blocks, and which shows up in that key's usage figures.
Your content
Each chatbot's indexed content is isolated. One chatbot cannot retrieve another's content, including across accounts.
Ownership is checked on every request. Chatbot data is only ever returned to the account that owns it.
Your content is not used to train public AI models. It is indexed so your own chatbot can search it, and that is all.
Uploads
Both the file type and the extension are checked on every upload. Filenames you supply are discarded entirely and replaced with generated ones, which removes an entire class of path-manipulation attack.
SVG images are rejected for chatbot logos. SVG files can contain executable scripts, and because uploaded images are served from our own domain, an SVG logo would be a way to run code in that context. PNG, JPEG and WebP cannot do this.
Conversations
Visitor conversations are stored so you can read them in the live inbox, review history, and take over in real time.
On the visitor's side, the conversation is remembered in their own browser. That is why closing a tab and returning keeps the thread, and why the same person on a phone and a laptop appears as two separate conversations.
What visitors should know
You are running a chat widget on your site. That carries obligations to the people using it — obligations SiteMesh cannot discharge for you.
Your privacy policy should say:
- That the site uses an AI chat assistant
- That conversations are recorded and may be read by your staff
- What happens to contact details submitted through lead capture
- How someone requests deletion of their data
In practice:
- Do not encourage visitors to type payment details, passwords or health information into a chat box
- Limit which staff can read transcripts to those who need to
- Honour deletion requests — leads can be deleted individually from the dashboard
- If your visitors are in the EU or UK, GDPR applies to what you collect here just as it does to a contact form
If you are unsure about your obligations, ask whoever advises you on data protection. This documentation is not legal advice.
Reducing what you hold
The most reliable way to protect visitor data is not to collect it. Before turning on lead capture fields, ask whether you will genuinely use them. Asking for a phone number nobody will ever ring is pure liability.
Reporting a security issue
If you believe you have found a vulnerability in SiteMesh, contact the team directly rather than posting details publicly. Include what you found, how to reproduce it, and what you think the impact is.