Architecture Encryption AI & your data Payments Access control Application security Data ownership Compliance Report an issue

01 — Architecture: who runs what

Chatworthy uses a carefully controlled, security-focused architecture designed to protect customer conversations, account data, and business operations:

AI reasoning
Enterprise AI processing. Agent replies are generated through secure commercial AI services with contractual data protections and independently audited security controls.
Application hosting
Managed cloud infrastructure. The Chatworthy platform runs on scalable cloud infrastructure protected by managed TLS, network security controls, and DDoS mitigation.
Database
Managed encrypted database. Conversations, agents, and settings are stored in a managed database with encryption at rest and automated backups.

Why this matters: your data is protected by layered physical security, network hardening, encryption, access controls, and independently audited infrastructure safeguards.

02 — Encryption, everywhere data moves or rests

  • In transit: all traffic — your dashboard, the chat widget on your website, and every API call — is encrypted with TLS (HTTPS). There is no unencrypted path into Chatworthy.
  • At rest: the database storing your conversations and configuration is encrypted at rest by the managed database provider.
  • Your AI API keys: if you connect your own supported AI API key, it is encrypted with AES-256-GCM before it is stored, and decrypted only in memory at the moment a reply is generated. Keys are never sent to the browser and never appear in logs; the dashboard shows only the last four characters.

03 — AI and your data: the question everyone should ask

Does the AI train on my customers' conversations? No.

Chatworthy generates replies through commercial AI services configured with enterprise data protections. Customer conversations are processed only to generate the requested reply and are stored in the appropriate Chatworthy workspace — they do not become shared training data.

  • We send the model only what it needs to answer: the conversation, your agent's instructions, and the relevant snippets of your knowledge base.
  • Your knowledge base content stays in your workspace. It is retrieved per-question, never shared across customers.
  • One customer's data is never used to answer another customer's questions. Workspace isolation is enforced at the database query level on every request.

04 — Payments: card data never touches Chatworthy

In-chat payments are deliberately designed so that Chatworthy never sees, stores, or transmits card numbers. When your agent presents a payment button, the customer pays on a secure hosted checkout page operated by a supported payment provider using PCI-compliant payment infrastructure.