Workspace boundaries
Customer data is retrieved through the signed-in user’s workspace membership. Widget conversation tokens are stored as hashes.
Security & privacy
Trust starts with
the foundations.
OviChat is in active development. The current source is designed around workspace-scoped records, hashed passwords, CSRF-protected forms and time-limited, hashed visitor tokens.
Honest status
OviChat has not completed a production security review, penetration test, backup restore exercise or compliance audit. Do not use it for sensitive customer data until those checks are complete.
Responsible setup
Set a strong application key, use HTTPS, restrict widget origins, configure mail delivery, and keep the web root pointed at the public directory.