Security and your customers' data

View as Markdown

Support conversations hold your customers’ words and sometimes their personal details. This article explains the controls that protect them and the ones you manage.

Your workspace is separate

Everything you create, such as conversations, customers, articles, ideas and settings, belongs to your workspace. Teammates see it only when they are members, and each request in the app is checked against the workspace it belongs to.

Control who gets in

Roles. Owners, admins and agents have different access. Agents never see settings or billing. See team roles.
Invitations. People join only by invitation to their own email address.
Passwords. Accounts use a password of at least 8 characters.

Identity verification. Sign the customer id on your server so nobody can read another customer’s conversations. See identify signed-in customers.
Allowed domains. Limit the widget to your own sites. See allowed domains.
Your secret stays yours. The identity secret is shown once and stored so that it cannot be read back. Rotate it if it leaks.

What the AI agent can see

The agent answers from the knowledge sources you add, and from the conversation it is in. It does not browse the wider internet, and it only discusses topics you allow. You can stop it using a source at any time by deleting the source. See how the AI agent answers.

Developer access

API keys, which also work for the MCP server, are secrets. Treat them like passwords, give each one only the scopes it needs, set an expiry where you can, and revoke any you no longer use under Settings, API keys. See the API docs and the MCP docs.

Questions about privacy or a security issue

Write to security@tirver.com for security reports, or hello@tirver.com for anything else.

Did this answer your question?