Comprehensive Security Hardening — Enterprise-Grade Protection

Security isn't optional. Widget code runs on your customer-facing pages with access to sensitive interactions. Our defense-in-depth approach layers multiple protections, ensuring security even if one layer is bypassed.

Content Security Policy (CSP) prevents XSS attacks

CSP headers specify which sources can load scripts, styles, images, fonts, and other resources:

• Widget JavaScript only loads from your trusted CDN or origin
• Inline scripts and styles are disabled unless hashed or nonce-protected
• eval and similar dangerous constructs are forbidden
• External API calls are restricted to approved domains
• Violation reports are sent to your security monitoring endpoint in real-time

CSP prevents 90%+ of XSS vulnerabilities by default.

Subresource Integrity (SRI) detects tampering

Every widget asset (JavaScript, CSS) is served with a cryptographic hash. Browsers verify the hash before executing code. If an attacker compromises your CDN or intercepts traffic, the hash won't match — browsers refuse to load the tampered resource.

Sandboxing isolates widget code

The widget runs in an isolated JavaScript module scope with limited access to the parent page:

• No reading cookies from the host domain
• No accessing localStorage or sessionStorage from the host
• No modifying parent DOM outside the widget container
• No interfering with parent page scripts or styles

Even if widget code is compromised, damage is contained.

Input sanitization and output encoding

• HTML is stripped or encoded (prevents XSS via message content)
• SQL special characters are escaped or parameterized (prevents SQL injection)
• File paths are validated (prevents directory traversal)
• All AI-generated responses are output-encoded before rendering

Cryptographic protections

• Data in transit encrypted with TLS 1.3 (forward secrecy)
• Data at rest encrypted with AES-256 (conversations, knowledge base, analytics)
• API tokens use JWT with RS256 signatures
• Cryptographic keys rotated regularly (90-day cycles) and stored in secure vaults (AWS KMS, HashiCorp Vault)

Compliance certifications

Security architecture supports compliance with:

• SOC 2 Type II — third-party audit of security controls
• ISO 27001 — information security management
• GDPR — data protection and privacy
• HIPAA — healthcare data security (if configured)
• PCI DSS — if handling payment card details in conversations