Security and privacy

Support conversations contain personal data. Here is how Svellyo handles it, and what you can control yourself.

Data protection

All traffic is encrypted in transit with TLS. Data is stored in encrypted Postgres databases and object storage.
Integration webhook URLs and workspace identity secrets are encrypted at rest with a key that never reaches the client.
Attachments are stored privately and served through short-lived links.
Team sessions can be reviewed and revoked from the account page. Superadmin access to a customer account is audit-logged and shown as a banner.

No cookies. The widget keeps one random token in localStorage, scoped to your workspace, so returning visitors see their history. Nothing to add to your cookie banner.
No third-party trackers or ad scripts are loaded. The bundle is 22 KB and runs inside a Shadow DOM, isolated from your page.
The widget only works on domains you allow. Every widget endpoint is rate-limited per visitor and per IP.
Verified identity: sign the user id with your workspace secret on your server and nobody can impersonate a customer or read their chats.

Retention windows per workspace: forever, 90 days or one year. A daily job permanently deletes conversations out of window, attachments included.
Export a contact's data or a whole workspace as JSON at any time.
Delete a contact to remove their identity and unlink their conversations, optionally deleting the messages too.
Delete a workspace or your whole account yourself. Owned workspaces are removed with everything under them after a short grace period.

Visitor messages and the relevant passages from your knowledge base are sent to the AI model provider to generate replies. Nothing else is shared.
The AI can be turned off per workspace. When it is off, no conversation content is sent for AI processing.
Every AI call is metered. You can see spend per workspace, and a daily cap protects you from abuse.

Hosted on Vercel with the database on Neon. Automated backups and point-in-time recovery are provided by Neon.
Every workspace-scoped query is checked against your membership on the server. There is no client-side trust.
Dependencies are pinned and the app is built and type-checked on every change in continuous integration.

Write to support@svellyo.com or use the chat in the corner. See also the privacy policy and terms.