Security and data handling

Every widget request carries the visitor’s page origin. SiteMind allows it when the origin belongs to one of your workspace’s connected domains (or a subdomain of one), when it’s an origin you’ve explicitly added under Widget → Access, or when there’s no origin at all, which covers same-origin requests, local tools, and native apps rather than another website loading your key. Everything else is rejected. This is the actual mechanism behind a copied embed snippet doing nothing on a site you haven’t connected.

Every workspace’s data, from crawled pages to conversation history, is scoped to that workspace. There’s no path in the product for one customer’s data to surface in another’s results, at the widget, dashboard, or knowledge base level.

Traffic to and from SiteMind runs over TLS. Stored data, including crawled content and uploaded documents, is encrypted at rest.

The chat endpoint your widget calls is limited per widget key rather than per visitor IP, 30 requests a minute, since what actually needs protecting is your monthly chat allowance, not any single visitor’s address. Authentication endpoints carry a stricter limit to blunt automated login attempts, and email-sending endpoints are limited separately to protect delivery quota.

Content you connect is used for one thing: answering your visitors through your own assistant. It isn’t used to train shared or foundation models, and it isn’t shared with other customers. For the broader trust and compliance picture, see the Security page.