Security overview

PepoChat sits between your customers and your tools, so it is built to expose as little as possible in either direction. This page lists what is in place; it states facts about the product, not certifications.

Your workspace is isolated

Each workspace's knowledge base, conversations, credentials and settings are stored in separate namespaces. A visitor's session can read only its own conversations, and only inside the workspace it was created in. Team members sign in with a verified email and a password, or with Google.

Credentials are encrypted and never shown again

Integration keys, OAuth secrets, refresh tokens and custom-action header values are encrypted with AES-256-GCM before they are stored. The dashboard shows header names, never values. Webhook URLs, which are the credential for Slack, Discord and Zapier, are stored as the action URL and are visible to workspace members; rotate them in the tool if they leak.

The agent reads only what you allow

Every action declares the response fields the agent may read. Everything else in a tool's reply, including personal data, never reaches the model. The agent summarises results and never repeats raw API output.

Outbound calls are guarded

Every call the agent makes to your tools is HTTPS-only, refuses private and internal hosts (checked by name and by DNS-over-HTTPS resolution), does not follow redirects, times out after 10 seconds, caps the response size, and escapes visitor input for the exact place it lands (URL, header, JSON, form or XML). Inputs with a known format are validated before any request.

Knowledge is treated as data, not instructions

Content retrieved from your knowledge base and results from tools are wrapped as untrusted data inside the prompt, so an instruction planted on a web page cannot steer the agent. Only the visitor's own explicit request can trigger a booking or an action.

Identity and personal context

Chats start anonymous. Personal features, meeting memory and pre-filled bookings, unlock only after a visitor verifies an email with a six-digit code that expires in 10 minutes, allows 5 attempts and is stored only as a hash. See Visitor email verification.

Abuse protection

Public endpoints are rate limited per visitor session and per workspace: message sending, new conversations, verification emails, votes and session creation each have their own limits. Messages are capped at 4,000 characters. Sign-up, sign-in and password resets are limited per IP address, and can be protected by a bot check.

Where the widget may run

The allowed-domains list restricts which sites can start a conversation with your agent. It is checked when a visitor's session is created and blocks casual misuse of your Organization ID. See Allowed domains.

Services involved

The backend runs on Convex, the dashboard and website on Vercel, AI replies use OpenAI models, transactional email goes through Resend, voice through Vapi when you enable it, and billing through Dodo Payments. PepoChat never stores your card details.

Reporting a vulnerability

Email support@pepochat.com with "Security" in the subject line. Please do not publish details until we have replied.