Trust Center
Data Handling Explained
A plain-language breakdown of what data is processed, where it goes, and how it is protected.
What data goes where
- Conversation content is processed to generate responses, analytics, and escalation context.
- Operational telemetry (latency, errors, routing events) is processed for reliability and incident response.
- Configured integrations (CRM/helpdesk) receive only mapped fields required for workflow handoff.
Model training
HoverBot does not train or fine-tune language models on customer conversations, and there is no setting that enables it. The only training HoverBot performs per workspace is of guardrail classifiers, on examples that workspace labels itself; those classifiers never leave the workspace.
- Conversation text is sent to the model provider's API for inference only, under terms that exclude API data from provider training.
- Where PII masking is enabled, detected entities are replaced before the text leaves HoverBot infrastructure. Detection runs on a service hosted inside the deployment.
- No opt-out is needed because there is nothing to opt out of. Ask the trust team if you need this in writing.
Which system holds what
Everything below except the last row runs inside one AWS deployment in Asia Pacific (Singapore).
| System | Runs where | Holds |
|---|---|---|
| Application and database (PostgreSQL) | AWS, Singapore | Configuration, transcripts, leads, audit logs |
| Vector index (pgvector) | Same deployment | Embeddings of your knowledge base, scoped to your workspace |
| Session cache (Redis) | Same deployment | Live conversation and skill state; expires after 24 hours |
| PII detection (Microsoft Presidio, self-hosted) | Same deployment | Message text in transit for detection; nothing stored |
| Language model and embeddings (OpenAI API) | Provider's infrastructure | Masked conversation text and retrieved passages, for inference only |
Tenant isolation model
- Logical tenant isolation separates conversation, configuration, and event data across workspaces.
- Role-based access controls and audit logs govern access to administrative and operational actions.
- Integration credentials are scoped by workspace and managed through encrypted secret storage.
Data residency and retention
All production data is stored and processed in one AWS region, Asia Pacific (Singapore), apart from the inference calls to the model provider described above. Other hosting regions are not available today. Planned
Transcripts are kept for the life of the workspace and deleted on request. A per-workspace retention setting exists in the compliance settings (default 90 days), but automated deletion on that schedule is not yet live. Planned
| Data class | Default handling | By agreement |
|---|---|---|
| Conversation transcripts | Singapore region; kept until deleted on request | Contractual deletion schedule; other regions not yet available |
| Operational logs | Singapore region; rotated on the host, no fixed period published yet | Fixed retention period |
| Integration payloads | Sent only to destinations the workspace configures, mapped fields only | Additional field minimization |
Need a formal policy packet?
Contact our trust team for policy details, data-handling clarifications, or account-specific controls.