Security and data
Your data, handled properly. And explained plainly.
Where your data is stored, who processes it and what you control. No small print, no vague promises.
At a glance
Your own database
Every customer’s conversations, leads and settings live in a separate database, not a shared table.
Encrypted
Encrypted in transit with TLS. Passwords are stored only as secure hashes, and database credentials and secrets are encrypted.
Not used to train AI
We use AI providers’ business APIs, which don’t use your data to train their models.
UK GDPR ready
A UK company, with a data processing agreement included on every plan.
Where your data goes
What happens when a visitor asks a question
Chati stores your data on our servers. To write an answer, it sends the question and the few relevant snippets from your content to an AI provider, which returns the reply.
- 1 · Your websiteA visitor asks a question
Sent securely from the chat widget.
- 2 · Chati platform · UK (London)Finds the right content
Searches your knowledge for the most relevant snippets. Conversations, leads and your content are stored here. The search index is held by Pinecone in the US.
- 3 · AI provider · United StatesWrites the answer
Receives only the question, the snippets and recent messages. Covered by our DPA and UK transfer safeguards.
- 4 · Back to your websiteAnswer, with its source
Or handed to your team if Chati isn’t sure.
You’re in control
Your data stays yours.
- Choose what Chati learns from. Pick the pages and documents; remove any at any time.
- Stored in the UK. Conversations, leads and your content stay on our servers in London. Only a search index of your website content is held in the US.
- Export or delete on request. Handle a visitor’s data request in a few clicks.
- Team permissions. Decide who can see chats, change answers or manage billing.
- Leave whenever you like. Cancel and we delete your data within 30 days, after giving you the chance to export it.
Connecting Chati to your database, safely
When we connect Chati to your own systems, it can only look things up. Every query is checked before it runs.
- Read-onlyIt can never change or delete data.
- Approved tablesOnly the tables and columns you allow.
- Scoped to the visitorCustomers only see their own orders or bookings.
- Checked and loggedHeavy or unsafe queries are blocked; every one is logged.