Security at ReeBot

Your workspace is kept apart

• Every request is checked against the workspace you belong to before anything is read or changed. Resources in other workspaces look exactly like ones that don't exist.
• Team roles (owner, admin, agent, viewer) limit who can change assistants, knowledge, billing and API keys.
• Privileged changes, such as role changes, API keys and data exports, are written to an append-only audit log.

Accounts and sign-in

• Passwords are hashed with Argon2id. Repeated failed sign-ins lock the account for a while, and sign-in is rate limited.
• Sessions use secure, HTTP-only cookies. Only a keyed hash of each session token is stored, and you can see and sign out your other sessions from account settings.
• Changing or resetting your password signs out your other sessions and sends you an email.

Secrets and data

• All traffic uses TLS. AI provider keys and messaging channel credentials are encrypted with AES-256-GCM and never sent to the browser or your website.
• API keys, visitor tokens and links in emails are stored only as keyed hashes. API keys are shown once, when you create them.
• Uploaded files are stored privately and never served back to the web.
• Logs leave out passwords, tokens, keys and the content of conversations.
• We don't use your content or your customers' conversations to train AI models.

The website widget

• The chat runs in its own isolated frame with a strict content security policy, so it can't read your page and your page can't read it.
• You can list the sites allowed to show your assistant; it won't load anywhere else.
• Everything the assistant writes is escaped before display, and links are limited to http and https.
• Visitor messages and imported content are treated as information, never as instructions, and the assistant can't browse, run code or reach other data.

Website import

Website import fetches only public http and https addresses, refuses private and internal networks, checks every redirect, and respects robots.txt. Read more about our crawler.

Privacy

See our privacy policy, data processing addendum and the list of sub-processors we use.

Report a vulnerability

If you think you've found a security problem in ReeBot, please tell us privately. Include what you found, how to reproduce it and the impact you think it has.

• We'll acknowledge your report within three working days and keep you updated while we fix it.
• Test only against your own account and data. Don't access other people's data, disrupt the service, run automated scans or use social engineering.
• Give us reasonable time to fix the issue before you share it with anyone else.

We won't take legal action against people who report vulnerabilities in good faith and follow these rules.