AI chatbot privacy and security: what businesses should check

AI chatbot privacy and security is a fair concern before you upload your documents or put a bot in front of customers. The questions are practical: where does the data go, who processes it, how long is it kept, and who can see it? This guide gives you a checklist that applies to any chatbot vendor, and explains how InstantKnowledgeBot handles each point, with links to our policies.

What data does a website chatbot handle?

Three kinds:

1. Your knowledge base: the documents and text you upload.
2. Visitor conversations: the questions people ask and the answers they get, plus technical details such as timestamps and the site where the bot was used.
3. Account and configuration data: your login, team members, settings, API keys and billing.

Each needs its own answer to "where does it go and how long is it kept?".

Where do documents and messages go?

When a visitor asks a question, a typical chatbot:

1. Receives the message on the vendor's servers.
2. Selects relevant parts of your knowledge base.
3. Sends those passages, the question and recent chat history to an AI provider to generate the answer.
4. Stores the conversation so you can review it.

So the key questions are: which AI providers are involved, and what are their data terms for API traffic? On InstantKnowledgeBot:

• Hosted bots use Anthropic (Claude) to generate answers.
• Bots on your own key use the provider you chose (OpenAI, Google, xAI or Anthropic) under your account and your agreement with that provider.

Our privacy policy lists these processors and what's sent to them.

What should you never put in a public chatbot's knowledge base?

A public website chatbot can quote anything in its knowledge base to anyone who asks the right question. So don't upload:

• Personal data about customers or employees.
• Confidential business information: contracts, salaries, unreleased plans.
• Credentials, internal URLs or security details.
• Content you don't have rights to.

For internal bots, embed them behind your existing sign-in and keep the share link internal; see internal knowledge base chatbots.

How long should conversations be kept?

Long enough to review and improve the bot; no longer. Look for automatic deletion. InstantKnowledgeBot deletes conversation logs automatically after a retention window and deletes activity records after a set period; the exact periods are in the privacy policy. You can also export or delete your data from the dashboard, and deleting your account deletes your bots, knowledge bases, conversations and keys.

How should visitor privacy be handled?

• Don't ask for more than you need. InstantKnowledgeBot doesn't ask visitors for names or emails unless you turn on lead capture; a conversation only contains personal details if the visitor types them.
• Tell visitors in your own privacy notice that you use an AI chat assistant and what it stores.
• Avoid sensitive data in chats and lead forms. Industry templates help: the clinic preset tells patients not to include medical details, and the law firm preset asks for a non-confidential description only. See the clinic chatbot page.
• Cookies: check whether the widget sets tracking cookies. Our chat widget doesn't run analytics inside the embedded chat.

How are API keys and accounts protected?

If you connect your own AI provider key, ask how it's stored. On InstantKnowledgeBot:

• Keys are encrypted at rest with AES-256-GCM.
• They're never shown again after saving, never returned to any browser, never logged, and only sent to the matching provider.
• You can test, replace or remove a key at any time.

For accounts: passwords are stored only as salted one-way hashes, sessions use secure HttpOnly cookies, you can review and revoke sessions, and all traffic uses HTTPS. Read more in bring your own key explained.

What about GDPR and other privacy laws?

Depending on where you and your visitors are, laws such as the EU and UK GDPR or California's CCPA/CPRA give people rights over their data. Practical steps:

• Update your privacy notice to mention the chatbot and its providers.
• Know your vendor's role and check its privacy terms.
• Use retention limits and minimise data.
• Handle requests: be able to export or delete data.

Our privacy policy explains the rights we support. This isn't legal advice; check with your adviser for your situation.

What certifications should you look for?

Enterprise buyers often require certifications such as SOC 2 or ISO 27001, and healthcare organisations in the US may need HIPAA business associate agreements. Some larger chatbot vendors advertise these on their own sites. InstantKnowledgeBot doesn't claim SOC 2, ISO 27001 or HIPAA compliance; it's designed for public business information on websites. If you need those assurances, choose a vendor that provides them.

How should you introduce the chatbot to visitors?

Transparency helps with both trust and privacy. A short welcome message such as "Hi! I'm an AI assistant. I answer from our published information. Please don't share sensitive personal details here." sets expectations from the first message. If you use lead capture, the form's prompt should say what you'll do with the details, for example "We'll only use this to reply to your enquiry."

What's the vendor checklist?

• [ ] Which AI providers process messages, and under what terms?
• [ ] How long are conversations and documents kept? Is deletion automatic?
• [ ] Can you export and delete your data?
• [ ] How are API keys stored?
• [ ] Is the data sold or used for advertising?
• [ ] Who on your team can access conversations?
• [ ] Are certifications needed for your industry?

To learn more about how these bots work, read what is a knowledge base chatbot, or see our terms and privacy policy. Questions? Contact us.