Security

Security is a first-class feature of AnswerDock, not an afterthought. Here is how we protect your data and your customers.

Tenant isolation

Every workspace's data — bots, sources, indexed content, conversations — is scoped by workspace and protected with row-level security in our database. The public chat API derives your workspace from a validated key, never from client input.

API key security

• All API keys are hashed at rest (SHA-256); secrets are shown once.
• Public widget keys only work on domains you explicitly allow.
• Keys can be disabled or rotated at any time.

Abuse protection

• Rate limiting by key, IP, and visitor.
• Message length and frequency limits.
• Monthly usage caps per plan.

Prompt-injection defenses

Content retrieved from your documents is treated as untrusted data. The assistant is explicitly instructed never to follow instructions embedded in indexed content and never to reveal its system prompt.

Your data, your models

We never use your content to train foundation models. You can delete sources and conversations at any time, and deletion cascades to the search index.

Responsible disclosure

Found a vulnerability? Email security@answerdock.ai and we'll respond quickly.