Security
Last updated 30 September 2026
At a glance
- Hosted on servers in the UK, with encrypted nightly backups in the EU.
- Encrypted connections everywhere, including live chat.
- No tracking: the chat stores nothing in a visitor’s browser until they send a message.
- You can export or permanently delete any visitor’s data yourself, in seconds.
Where your data lives
Chatterbell runs on a dedicated server in the United Kingdom. Every night we take a consistent copy of the database and files. One copy stays on the server for 14 days, and an encrypted copy goes to a separate data centre in the EU, kept for 30 days plus monthly copies for a year. A few providers help us deliver specific features, such as AI answers and email. They’re listed, with where they operate, in our data processing agreement.
How we protect it
- Encryption: HTTPS/TLS for the website, the app, the chat button and live connections. Off-site backups are encrypted with AES-256 before they leave our server.
- Accounts: passwords are stored only as salted scrypt hashes. Changing your password signs you out everywhere else.
- Separation: every request checks that you belong to the workspace you’re looking at, and cross-site requests are blocked.
- Files: photos and documents are checked by their actual contents, limited in type and size, and sandboxed so they can’t run as web pages.
- The service itself: runs as an isolated, unprivileged process, with rate limits against abuse.
- AI: the AI only sees your website, your notes and the chat it’s answering. Our AI provider doesn’t train on it.
You stay in control
- Chats are kept for your plan’s history period, and you can delete any chat yourself at any time.
- Download everything as a spreadsheet or JSON, or one visitor’s data when they ask.
- Permanently delete a visitor and every chat, message, photo and file linked to them.
- Owners and admins control who’s on the team and what they can change.
Reporting a security problem
If you think you’ve found a security issue, please email hello@chatterbell.com with the details. We’ll reply within two working days and keep you updated while we fix it. Please don’t access other people’s data or disrupt the service while testing, and give us a reasonable chance to fix the problem before telling anyone else. Our security.txt has the same details.