Security & Data Handling
Understand how our website and product assistant handle information, where human review fits, and what to confirm before a customer deployment.
Updated November 3, 2026
This overview describes the public website and its connected B2B consultation workflow. A builder's production deployment requires its own agreed scope, access permissions, provider settings, and retention arrangements.
01
How information moves
Contact, guide, and consultation requests pass through website server endpoints to the platform CRM. The website product assistant sends conversation context to the platform AI service to generate responses. Relevant information is processed by connected services; it does not remain exclusively in the visitor's browser or a builder's CRM.
02
Access and integration credentials
The B2B integration uses a server-side shared credential. CRM administration uses authenticated, permission-checked endpoints. The website assistant is routed to platform B2B workflows rather than customer-specific homeowner records. B2B intake includes request limits and validation; those controls must also be checked in the deployed environment.
03
Records and retention
Requests may include name, company, email, phone, discussion notes, preferred meeting time, and consent. Authorized platform staff can review assistant transcripts, activity, and notification errors. Website assistant transcripts and related activity logs are scheduled for deletion after 30 days of inactivity; submitted lead and inquiry records are retained separately for follow-up. Contact us about access or deletion requests.
04
AI and connected providers
The custom website assistant uses the CRM's configured AI provider. The website also includes a separate Botpress chat; payments, uploads, and notifications use their configured third-party services. Provider processing and retention depend on the enabled services, account settings, and applicable agreements. This overview makes no blanket zero-retention, model-training, or data-residency guarantee.
05
Human review and consultation requests
AI responses can be incomplete or incorrect. Staff should review consequential decisions. A Product Consultation request records the visitor's preferred date, time, and timezone and remains pending team confirmation; it does not reserve a calendar slot. Email and SMS provider acceptance is distinct from verified inbox or handset delivery.
06
Review before deployment
Ask the team to confirm the data flow, authorized users, provider contracts, retention settings, integration permissions, hosting controls, and incident-reporting process for your proposed deployment. This document is an architecture overview, not an independent security assessment or a claim of SOC 2 certification, SSO availability, specific encryption settings, or risk-free operation.
Questions or concerns?
Use our contact page to request an architecture discussion or raise a security concern. Do not send passwords, API credentials, payment information, or sensitive homeowner records through the public chat.
Contact our teamRead the privacy policy