Publication Condition: Replace every highlighted placeholder field with an evidence-backed production fact before publishing.

Trust Centre

Security and Data Handling

Learn how BotSpace handles customer messages, knowledge, credentials, workspace access, AI processing, providers, retention and security incidents.

Report a Security Concern Read the Privacy Policy

Last reviewed: Verified review date Security owner: Responsible role

BotSpace processes customer conversations, enquiry information and approved business knowledge to provide the Omnichannel Enquiry Desk and enabled operational features.

This page explains how information moves through the service, the safeguards applied by BotSpace, the responsibilities of connected providers and the actions customers must take to protect their workspaces.

Disclaimer: No internet-connected service can guarantee absolute security. BotSpace does not claim a certification, control or service commitment that has not been independently verified.

Security overview

The following table must contain only controls operating in the production environment.

Security area	Verified BotSpace position
User authentication	Authentication method, password reqs, MFA availability
Staff access	Role and least-privilege controls
Workspace separation	Logical tenant-isolation method and testing
Data in transit	Verified TLS scope
Data at rest	Database, storage and backup encryption scope
Credential protection	Secret-storage and access method
Security logging	Events recorded, redaction and retention
Monitoring	Automated and human monitoring coverage
Backups	Systems covered, frequency and retention
Recovery testing	Last completed test or approved cadence
Incident response	Approved response process
Primary processing location	Country or region
Security certifications	List verified certifications or state 'None currently claimed'

Controls can differ by service, plan, integration, hosting arrangement and provider. Dedicated infrastructure, customer-specific keys or a particular data location apply only when expressly offered and agreed.

How does information flow?

The detailed interaction process:

A customer sends a message through website chat or a connected messaging channel.
The channel provider transmits the event to BotSpace.
BotSpace associates the event with the appropriate workspace and conversation.
The service may retrieve information from sources approved for that workspace.
The minimum information required for the enabled function may be sent to an approved AI or infrastructure provider.
BotSpace returns a response or transfers the enquiry to authorized staff.
Conversation, enquiry, usage and security records may be stored according to the applicable configuration and retention schedule.

Information categories

Category	Examples	Purpose
Account information	Users, roles, business settings and plan	Administer the workspace
Channel information	Connected accounts, identifiers and provider events	Receive and send messages
Conversation information	Messages, responses, notes and summaries	Operate the enquiry desk
Enquiry information	Name, contact details, requirements and status	Capture and route requests
Knowledge information	Documents, webpages and FAQs	Support approved answers
Operational information	Quotations, workflow tasks and related records	Provide enabled add-ons
Technical records	Login, configuration, delivery and error events	Secure and operate the service
Usage information	Monthly Active Enquiry and provider activity	Measure service usage

Customers should configure BotSpace to collect only the information reasonably necessary for the intended process.

Access and workspace separation

Access to BotSpace should be based on an authenticated user, assigned role and legitimate operational need.

Implemented Access Controls

• User authentication• Multifactor authentication (MFA)• Password and session management• Workspace roles• Privileged administration• Staff support access• User invitation and removal• Dormant-account review• Administrative-event logging

The final public page must detail the specifics of these controls.

Workspace separation

Each BotSpace customer operates within a logically separated workspace. Logical separation does not mean that every customer receives physically dedicated infrastructure.

Tenant isolation must cover:

• Application authorization
• Database queries
• Conversation and enquiry records
• Knowledge indexing and retrieval
• Connected-channel credentials
• Workflow execution
• Background jobs
• Reports and exports
• Support administration

BotSpace personnel access

Use the following wording only after the access process is operational:

"Authorized BotSpace personnel may access customer information only when required for support, security investigation, service operation or another approved purpose. Access is restricted according to role and operational need and is recorded where technically supported."

Credentials and accounts

Connected services may require:

OAuth tokens
Channel access tokens
API credentials
Webhook-signing secrets
Service-account credentials
AI-provider keys
Database and storage credentials

Verified lifecycle must cover:

Secure connection or creation
Restricted storage
Minimum required permissions
Use by authorized services only
Rotation where supported
Revocation after suspected exposure
Revocation on relationship end
Logging that excludes secret values

Credentials must NOT be stored in:

Source-code repositories
Public documents
Ordinary knowledge sources
Analytics records
Support screenshots
General chat messages
Client-side application code

OWASP recommends managing secrets throughout their lifecycle. If a credential may have been exposed, revoke or rotate it through the relevant provider and report the concern to BotSpace.

Encryption

Context	Verified detail required
Browser to BotSpace	Protocol and enforced HTTPS scope
Channel to BotSpace	Provider and webhook transport protection
BotSpace to AI provider	Transport protection
Production database	At-rest encryption and key owner
Uploaded files	Storage encryption and access controls
Backups	Backup encryption and key access
Credentials	Additional secret-specific protection
Exports	Protection while generated, stored and downloaded

Constraint: Do not state "end-to-end encrypted" unless only the intended communicating parties can decrypt the information throughout the complete communication path. Messaging providers, BotSpace, infrastructure services and enabled AI providers may need to process message content.

AI and Knowledge Security

AI-assisted functions introduce risks beyond ordinary application security, including direct prompt injection, indirect instructions in uploaded documents, content retrieval from wrong workspaces, knowledge-source poisoning, and unauthorized tool actions.

Required AI Security Controls

Before publishing this section as an implemented claim, verify:

• Messages treated as untrusted content
• Approved ingestion process for sources
• Knowledge scoped to correct workspace
• Content cannot override system instructions
• Model output validated before actions
• Least-privilege AI tool permissions
• Tool inputs validated independently
• High-risk actions require authorization
• Suspicious inputs/tools are monitored
• Provider changes regression-tested
• AI failure has safe human-handoff path

Strict limits on AI authority

AI may assist with answering, extraction, classification, summaries, drafting and recommendations. AI must NOT independently:

• Confirm a final price
• Confirm live availability without authoritative source
• Finalize a booking
• Mark a payment as received without verified evidence
• Approve a refund
• Change supplier bank details
• Access another workspace
• Perform a destructive administrative action

Logging and monitoring

Security and operational logs may record:

Authentication & authorization outcomes
Privileged actions & role changes
Workspace, channel & knowledge changes
Workflow execution failures
Integration and webhook errors
Suspicious access or usage patterns
Backup, recovery and deletion outcomes
AI tool invocation and approval decisions

The final page must accurately state:

• Which events are recorded
• Who can access the logs
• Retention period per category
• Whether alerts are automated
• Human monitoring availability
• Escalation triggers

Logs should not contain passwords, private keys, complete access tokens or unnecessary customer-message content. Do not claim "24/7 monitoring" unless both monitoring and human-response arrangements support that statement.

Retention and deletion

BotSpace should maintain a separate retention rule for each information category.

Information category	Required verified rule
Account and workspace records	Retention period
Conversations and handoff notes	Retention period and customer options
Enquiry and contact information	Retention period
Knowledge sources	Active period and deletion process
Derived retrieval data	Deletion relationship to source
Workflow and operational records	Retention period
Usage and billing records	Legal and accounting period
Security and audit logs	Period by log category
Exports and temporary files	Expiry period
Backups	Maximum lifecycle

When an authorized deletion request is accepted, relevant information should be deleted or de-identified from active systems according to the documented workflow. Restricted copies may remain temporarily in backups, security evidence or provider systems where immediate deletion is not technically possible or legally required. The detailed privacy position belongs in the BotSpace Privacy Policy.

Backups and recovery

The public description must be based on a completed recovery test, not merely the existence of a backup job.

Verify and document:

Systems included in backups Backup frequency Retention and rotation Encryption standards Access restrictions Geographic location Backup-success monitoring Restoration procedure Last successful restoration test RPO (if contractually offered) RTO (if contractually offered) Reapplication of deletion post-recovery

Customers should retain authoritative copies of critical business information. BotSpace should not be described as the customer's only archival system unless a contract expressly provides that service.

Providers and Dependencies

BotSpace may depend on providers for:

Hosting, databases, storage
AI models and embeddings
Authentication & Messaging channels
Email, Monitoring & error reporting
Payment administration

Inventory must identify:

• Provider & Service purpose
• Information processed
• Processing location
• Retention behaviour
• Relevant contractual role
• Access termination process

ChatbotX dependency

BotSpace uses software components based on ChatbotX. Its stated response target belongs to the upstream project and must not be presented as a BotSpace commitment. BotSpace must independently track upstream releases, test updates, apply fixes securely, and verify the service post-deployment.

Using open-source software does not transfer operational security responsibility from BotSpace to the upstream maintainer.

Incident Response

BotSpace should maintain a documented incident-response process integrating identification, assessment, containment, investigation, recovery, notification, and review.

The final public wording should state:

"If a verified incident affects customer information or service access, BotSpace will communicate with affected parties according to applicable law, contract and available verified contact information."

Do not promise a notification time that is not supported by law, contract and the exercised response process.

What are customers responsible for?

Selecting trustworthy workspace administrators
Protecting user devices and email accounts
Assigning the minimum access staff require
Removing access promptly when staff leave or change roles
Protecting connected channel and provider accounts
Reviewing permissions granted to integrations
Uploading only authorized knowledge sources
Keeping prices, policies and operational info current
Avoiding unnecessary collection of sensitive information
Reviewing unusual workspace or provider activity
Reporting suspected compromise promptly
Maintaining independent copies of critical business records

Customers must not use BotSpace to obtain credentials, access another party's information, bypass provider rules, conduct unlawful monitoring or perform unauthorized automated actions.

Reporting a security concern

Use the Security option on the BotSpace Contact page to report suspected unauthorized access, exposed credentials, cross-workspace information, integration failures, or suspected vulnerabilities.

Include, where safe:

• Affected page, feature or integration
• Workspace ID without credentials
• Date, time and time zone
• Concise description
• Safe reproduction steps
• Sanitized screenshot/error message
• Safe follow-up contact

Do NOT:

• Include passwords or full tokens
• Access another customer's info
• Perform destructive testing
• Disrupt the service
• Use social engineering
• Continue testing post-confirmation

Report a Concern Read Privacy Policy

Security questions

Is BotSpace end-to-end encrypted?

Requirement
Explain the verified transport and storage protections separately. Do not answer 'yes' unless the complete channel-to-recipient path has been verified as end-to-end encrypted.

Does BotSpace have ISO 27001 or SOC 2 certification?

Requirement
State 'No certification is currently claimed' unless BotSpace has completed and can evidence the relevant certification or examination.

Can BotSpace staff access customer conversations?

Requirement
Authorized access may be required for approved support, security or operational purposes. Publish the exact role, approval, logging and review controls.

Is each customer hosted on separate infrastructure?

Not by default. Logical tenant separation does not mean each customer receives dedicated physical infrastructure.

Does an AI provider train on customer information?

Requirement
This requires a definitive provider-by-provider answer based on production settings and contracts. It must match the Privacy Policy and data-processing agreement.

Where is BotSpace information stored?

Requirement
Publish verified primary and backup regions, provider locations and any customer-selectable residency options.

What should I do if a channel token is exposed?

Revoke or rotate it through the provider immediately, review relevant activity and report the concern to BotSpace.

Internal Pre-Publication Checklist

This section is for internal tracking and must be removed prior to public launch.

Critical publication gates:

Production architecture & data-flow diagram
Authentication, MFA & session controls
Role & privileged-access matrix
Cross-workspace isolation tests
Credential storage, rotation & revocation
Encryption in transit and at rest
AI and retrieval threat model
Prompt-injection & tool-permission tests
Logging coverage & secret redaction
Monitoring hours & escalation process
Retention periods for every data category
Backup scope & restoration test
Approved & exercised IR plan
Provider inventory (Hosting, AI, Support)
ChatbotX upstream patch process
AI-provider training & retention position
Processing & backup locations
Monitored Security contact route
Alignment with Privacy & Terms
Canonical URL & XML sitemap entry

Evidence Register Assignments

Control	Required Evidence	Owner
Authentication	Configuration and test results	Engineering
MFA	Supported roles and enforcement evidence	Engineering
Authorization	Role matrix and negative tests	Product/Eng
Tenant isolation	Cross-workspace test suite	Eng/Security
Encryption	Provider settings and architecture	Infrastructure
Secrets	Secret inventory, rotation and revocation test	Infrastructure
Logging	Event catalogue and redaction test	Engineering
Monitoring	Alert inventory and response process	Operations
AI safeguards	Threat model and adversarial tests	AI/Product
Backups	Job evidence and restoration test	Infrastructure
Retention	Approved schedule and deletion test	Privacy/Eng
Providers	Inventory, contracts and locations	Legal/Ops
Incident response	Approved and exercised plan	Sec/Leadership
Upstream software	Version and patch register	Engineering