Where is my data stored?

In the UK/EU on our Kubernetes cluster. Conversation data, sources and embeddings never leave that region except for model inference calls to the provider you selected.

Can I restrict where my widget loads?

Yes. Allow-list domains per agent; requests from any other origin are rejected.

Do you offer a DPA or security questionnaire?

Yes. Email hello@threadbox.ai and we will send our DPA and answer your questionnaire, usually within two working days.

How do I delete a visitor's data?

Delete the conversation from the inbox or via the API; leads, messages and analytics rows tied to it are removed.

Do you have SOC 2 or ISO 27001?

Not yet. We follow the controls above and are happy to walk your security team through our architecture and processes.

Security & trust

Your customers' conversations deserve real protection

Security is a set of defaults, not a checkbox. This is how Threadbox is built and run.

UK/EU hosted
Encrypted at rest & in transit
Zero-retention model APIs
DPA available
UK GDPR
HMAC-signed webhooks

Encryption everywhere

TLS 1.2+ on every connection. Databases and object storage encrypted at rest. API keys and channel tokens are hashed or stored encrypted and never shown twice.

Workspace access control

Owner, admin, agent and viewer roles. Invitations expire, memberships are auditable, and API keys are scoped (read / write / chat) and revocable instantly.

AI guardrails

Prompt-injection detection, blocked topics, system-prompt leak checks and a configurable fallback answer. Custom actions only ever call the endpoints you define.

Your data trains your agent only

Content you upload is used solely to answer your customers. We do not train foundation models on your data, and model providers are used under their zero-retention API terms.

Data residency & retention

Hosted in the UK/EU on our Kubernetes cluster. Delete a bot and its sources, embeddings and conversations go with it; delete your account and everything is purged.

Signed integrations

Outbound webhooks are HMAC-SHA256 signed with per-endpoint secrets. Inbound Slack, WhatsApp and email webhooks are signature-verified before anything is processed.

Operational hygiene

Immutable container builds, migrations run as reviewed jobs, secrets in the cluster not in code, rate limiting on public endpoints, and structured error monitoring.

UK GDPR ready

Cookie consent with Consent Mode, a plain-English privacy policy, DPA on request, and tooling to export or erase a visitor's conversations when they ask.

Transparency

Sub-processors

Third parties that may process data on our behalf. We will notify workspace owners before adding any.

Sub-processors
Provider	Purpose	Region
OpenAI, Anthropic, Google	Language models (zero-retention API terms)	US/EU
Kubernetes hosting provider	Application hosting, databases, object storage	UK/EU
Brevo	Transactional email	EU
Stripe	Billing and invoicing	EU/US
Meta (WhatsApp Cloud API)	WhatsApp channel, only if enabled	Global
Slack	Slack channel, only if enabled	US

Need the paperwork?

We complete vendor questionnaires and sign a DPA before you commit. Uptime is published on our status page.

Request our DPA Status page

Questions

Common security questions

OpenAI, Anthropic and Google, via their enterprise APIs under zero-retention terms. You choose the model per agent. Prompts and content are sent only to the provider of the model you selected.

Secure by default, live in minutes

Build an agent on your own content and review exactly what it will say before it goes live.

Start free

No credit card · Live in minutes · Cancel anytime