Trust and security

Encrypted connections

assistlychat.com, the dashboard and the chat widget load over HTTPS, so what you and your visitors type is encrypted on the way. Browsers are told to always use HTTPS for our site (HSTS).

Passwords

We never store your password. We keep only a one way bcrypt hash of it, so nobody can read it back, including us.

Password reset links work once and expire after one hour. Too many sign in attempts from one network are blocked for 15 minutes.

Two step sign in and passkeys

• New accounts confirm their email with a 6 digit code.
• A fresh code is asked on a new device and on every 20th sign in. A code works for 10 minutes and stops after 5 wrong tries.
• You can turn on an authenticator app, with one time backup codes. Its key is stored encrypted.
• Passkeys let you sign in with your fingerprint, face or device PIN. The biometric never leaves your device.
• Settings lists your remembered devices, and one tap signs out every other device.

Sign in cookies can't be read by scripts on the page and are only sent over HTTPS.

Your data

Your business owns its chats, leads and bot knowledge. Every dashboard request is tied to the account that is signed in, so one account can never read another account's chats or leads.

You can delete any conversation (with its pictures), any lead and any knowledge source from your dashboard at any time.

On Starter and up you can download all your leads as a spreadsheet file (CSV).

To have your whole account and its data deleted, email support@assistlychat.com.

Where your data is hosted

The Assistly app runs on Render in its Virginia region in the United States. The database is hosted by MongoDB Atlas. Traffic to assistlychat.com passes through Cloudflare's network, which also helps block abuse.

AI and your chats

Chat replies are written by OpenAI's models. To write a reply, the visitor's message, the recent chat and the relevant parts of the business's own information are sent to OpenAI.

OpenAI's data controls page states that data sent to its API is not used to train or improve its models unless the account owner opts in, and that its abuse monitoring logs are kept for up to 30 days by default.

Service providers

• RenderRuns the Assistly app
• MongoDB AtlasHosts the database
• OpenAIWrites the AI chat replies
• ResendSends lead alerts, sign in codes and account emails
• CloudflareNetwork in front of assistlychat.com
• MetaWhatsApp messages, only for businesses that connect their WhatsApp number