Developer / Security & privacy

Security & isolation

WebChat AI is built with multi-tenant data isolation, cryptographic session management, origin validation, SSRF crawler defenses, and strict ingestion bounds.

Multi-tenant data isolation

How tenant data boundaries are strictly enforced across storage, search, and retrieval.

Every organization in WebChat AI is assigned an immutable tenant_id. All data structures—including assistant configurations, crawled web documents, vector embeddings, file attachments, and conversation transcripts—are partitioned by tenant:

Tenant Isolation Architecture

Enforced at every layer from API boundary to storage partitions.

LAYER 1

Principal Extraction

Incoming requests authenticate via JWT session or API key, resolving principal.tenant_id.

LAYER 2

Service Boundary

Service layer enforces tenant scope. Cross-tenant reads or writes fail before database execution.

LAYER 3

Database Scoping

All database queries and vector searches include tenant_id compound indexes.

LAYER 4

Storage Partitions

Uploaded files and vector attachments are stored in tenant-isolated namespaces.

Origin validation & allowed domains

Prevent unauthorized third parties from embedding your assistants or consuming your AI quotas.

By default, every assistant enforces an allowlist of authorized hostnames (allowed_domains). When the widget initializes on an end-user page, the backend validates the incoming Origin and Referer headers against this allowlist:

Exact Domain Match: Specifying example.com allows embedding on https://example.com.
Wildcard Subdomains: Specifying *.example.com authorizes all subdomains (e.g. docs.example.com, app.example.com).
Local Development: In non-production environments, requests from localhost and 127.0.0.1 are permitted automatically to streamline local testing.
Rejection: If a disallowed domain attempts to mount the widget, the handshake returns 403 WIDGET_ORIGIN_NOT_ALLOWED.

5-Minute Widget Cache Window

Public widget configuration (including allowed domains) is cached server-side in Redis for up to 300 seconds (5 minutes) with best-effort invalidation upon dashboard updates.

SSRF crawler defense

How the ingestion pipeline blocks Server-Side Request Forgery attacks.

When an assistant is configured to crawl a website, the ingestion crawler performs rigorous DNS resolution and IP filtering before dispatching HTTP requests. The crawler categorically rejects:

Blocked IP spaces for SSRF prevention
CIDR Block / Destination	Classification	Security Rationale
127.0.0.0/8, ::1	Loopback Address	Blocks requests directed at local host services and internal admin daemons.
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16	RFC 1918 Private Ranges	Blocks scanning of internal VPC networks and private cluster databases.
169.254.0.0/16, 169.254.169.254	Link-Local / Cloud Metadata	Prevents theft of cloud instance IAM credentials and Kubernetes tokens.

File upload bounds & parsing safety

Preventing resource exhaustion, memory denial-of-service, and malicious attachments.

Strict File Type Whitelist: Only .pdf, .docx, .md, and .txt files are accepted. Binary executables, scripts, and archives (.zip, .tar) are rejected immediately (400 UNSUPPORTED_MEDIA_TYPE).
Batch & File Size Caps: Maximum 10 MB per upload batch and maximum 5 files per batch (400 DOCUMENT_TOO_LARGE).
100-Page PDF Limit: PDFs exceeding 100 pages are rejected to prevent parser CPU starvation and memory spikes.
Encrypted PDF Rejection: Password-protected PDFs cannot be safely inspected or chunked and are immediately flagged with a helpful user prompt.

Content Security Policy (CSP)

Configuring your site's CSP headers to allow the WebChat AI widget.

If your web application publishes a strict Content Security Policy, ensure your server includes the WebChat AI script and connect origins:

Content-Security-Policyhttp

Content-Security-Policy:
  script-src 'self' https://api.webchat.ai;
  connect-src 'self' https://api.webchat.ai;
  font-src 'self' https://fonts.gstatic.com;
  style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;