Trust Center
Data Use, Security, and Compliance
This page summarizes how HoverBot handles customer data, model training controls, retention, service reliability, and compliance progress.
Compliance status
Certifications and compliance at a glance
GDPR + PDPA Controls
Operational privacy controls including retention schedules, access governance, and quarterly policy reviews.
SOC 2 Type II
Control maturity workstream active: evidence collection and readiness documentation in progress.
ISO 27001
Scoping and sequencing decisions under evaluation following SOC 2 milestone progress.
How to read the labels on this page
- Available
- Shipped and in use on every workspace. You can enable it today without talking to us.
- Pilot
- Working on design-partner workspaces. Enabled per tenant by the HoverBot team, may change before general release.
- Planned
- On the roadmap. Not in the product yet, so do not buy on the assumption it will arrive by a given date.
- Target
- A number HoverBot is built and tuned to reach. Not yet confirmed on a production customer cohort.
Data Use Policy
Last reviewed: September 2026
- Customer conversation data belongs to the customer account owner.
- Data is processed to provide chatbot responses, analytics, and support workflows.
- HoverBot does not train or fine-tune language models on customer conversations. Conversations are sent to the model provider's API for inference under terms that exclude API data from provider training. There is no opt-in that changes this.
- Sensitive values are redacted by policy rules before downstream model calls when configured.
Retention Schedule
Last reviewed: September 2026
| Data Type | Default Retention | Notes |
|---|---|---|
| Conversation transcripts | Life of the workspace; deleted on request | A per-workspace retention setting exists (default 90 days) but automated deletion on that schedule is not live. Planned |
| Conversation session cache | 24 hours | In-memory session and skill state expires automatically. Available |
| Operational and audit logs | Rotated on the host; no fixed period published yet | Used for security and incident investigations. A published retention period is planned. Planned |
| Lead capture exports | Per destination system policy | Governed by CRM/helpdesk retention settings |
Security Controls
Last reviewed: September 2026
- Encryption in transit and at rest
- Role-based access controls and audit logs
- PII masking and guardrail enforcement options
- Incident response triage with security contact workflow
Not available yet
- Planned Single sign-on (SAML or OIDC) for the admin console
- Planned Multi-factor authentication for admin accounts
- Planned Automated deletion on the per-workspace retention schedule
- Planned Hosting regions other than Singapore
Listed so a security review does not have to ask. Dates are not promised.
Hosting and Subprocessors
Last reviewed: September 2026
Production runs in a single AWS region, Asia Pacific (Singapore). The database, vector index, cache and the PII detection service run inside that deployment and are not subprocessors. The parties below receive customer data.
| Subprocessor | Purpose | Data received |
|---|---|---|
| Amazon Web Services | Hosting of the application, database and cache; transactional email | All customer data at rest, Singapore region |
| OpenAI | Language model inference and text embeddings via API | Conversation text and retrieved knowledge passages, after PII masking where enabled. Not used for provider training under API terms. |
| Vercel | Hosting of this marketing site only | Form submissions from this site. No chatbot conversation data. |
Channel providers a workspace connects (for example WhatsApp) receive the messages exchanged on that channel under their own terms.
Uptime and Reliability
Last reviewed: September 2026
HoverBot targets 99.9% monthly availability objective for production services. Current service state and the public record of customer-affecting incidents are published on the system status page, which also serves the same data as JSON.
Enterprise SLA terms are available through contractual agreements.
Compliance Status
Last reviewed: September 2026
- GDPR and PDPA operational controls in place
- SOC 2 Type II readiness work in progress
- Quarterly policy and control review cadence
Compliance Roadmap
Last reviewed: September 2026
GDPR + PDPA controls (operational)
Retention, access governance, and policy controls are active in current operations.
SOC 2 Type II (in progress)
Readiness workstream in progress with controls and evidence collection.
ISO 27001 (evaluation phase)
Scoping and sequencing decisions are being evaluated after SOC 2 milestones.
Evidence for Published Claims
Last reviewed: September 2026
- Chatbot Benchmark Methodology for every published range: its definition, how it is measured, its provenance label, and its limitations. Today every outcome range is a target; the page says when that changes.
- E-commerce Support Automation - illustrative scenario. Modeled from demo-tenant data, not a customer measurement.
- Real Estate Lead Qualification - illustrative scenario. Modeled from demo-tenant data, not a customer measurement.
- SaaS Onboarding Automation - illustrative scenario. Modeled from demo-tenant data, not a customer measurement.
Third-party listings and reviews
HoverBot is listed on the following independent platforms. Visit these profiles for external reviews, ratings, and independent assessments.
Questions or requests
For data-processing questions, model training opt-out, or security documentation requests, contact our team and reference “Trust Center”.
Compliance & data handling FAQ
How HoverBot approaches compliance, GDPR, and PII as a compliance-first AI chatbot platform.
Still have questions? Talk to us →01Is HoverBot a compliance-first AI chatbot platform?
Yes. HoverBot is built compliance-first: PII masking, guardrails, DLP and content filtering, per-tenant isolation, and exclusion of customer data from model training are part of the platform rather than add-ons.
02How does HoverBot support chatbot GDPR compliance?
HoverBot supports GDPR through data minimization (PII masking and redaction before prompts and logs), purpose limitation, configurable retention, access controls, and data residency options. Customers remain the data controller; HoverBot acts as a processor under a DPA.
03Does HoverBot train its models on our customer data?
No. Customer conversations and uploaded knowledge are not used to train shared or third-party foundation models. Data stays isolated to your tenant and is used only to operate your chatbots.
04Can HoverBot mask PII and apply DLP on customer support chatbots?
Yes. PII masking and DLP/content filtering run on both inbound queries and model outputs, so sensitive data is detected and protected before it is stored, logged, or shown in customer support conversations.