Security and data handling
How SiteWhizz handles your data
What we store, where it lives, which providers process it, and what you control. If your compliance team needs more detail, ask us directly.
What your agent can see
Your agent works from the content you give it: website pages, PDFs, documents and text you paste in. It has no access to your other systems, databases or customer accounts.
Answers come only from the content you add, visitors see answers but never your raw documents, and you write rules for what the agent must never ask or say.
At a glance
- What we store
- The content you add, conversations with your agent, and lead details visitors choose to share
- What we never store
- Passwords (you sign in with Google or an emailed code) and full card numbers (Lemon Squeezy handles payment)
- Never
- Sold, rented, shared for marketing, or used to train public AI models
Safeguards
How we protect it
The safeguards in place today.
Encryption
Traffic to the website, dashboard and chat widget uses HTTPS. Your database and uploaded files are encrypted at rest by our hosting providers.
Sign-in
Sign in with Google or with a one-time code sent to your email. SiteWhizz doesn't store passwords.
Audit log
Changes to your account, agents and content sources are recorded in an audit log.
Separate agents
Each agent answers only from its own content sources, so one site's documents never show up in another site's answers.
Rules you write
Tell the agent what it must never do, such as ask for an account number or give legal advice, and when to hand off.
Report a vulnerability
Found a security issue? Email admin@sitewhizz.io and we'll look into it right away.
Providers
Where your data lives
SiteWhizz runs on these providers. Each one processes your data only to deliver the service.
Supabase
Database
Accounts, content, conversations and leads
OpenAI
AI provider
Embeddings and the agent's answers. Data sent through OpenAI's API is not used to train their models.
Amazon Web Services
Storage and email
Uploaded files (S3) and account email (SES)
Railway
Hosting
The SiteWhizz API
Netlify
Hosting
The SiteWhizz dashboard
Lemon Squeezy
Billing
Payment details. SiteWhizz never sees your full card number.
SiteWhizz does not hold SOC 2 or ISO 27001 certification. If you need a security questionnaire completed, contact us.
Your control
Export, delete, decide
Data deletion
Remove content sources from your dashboard at any time. To delete your whole account and its data, email us and we'll complete it within 30 days.
Data export
Download your conversations and leads as CSV files from the dashboard.
No data selling
We never sell or rent your data, or share it for marketing. Conversations are used only to run your agent.
Have security questions?
Tell us what your compliance team needs to know and we'll answer directly.