// SECURITY & DATA HANDLING
ChatGenius security.
Bring your data-handling, access and procurement requirements. We can discuss the proposed ChatGenius setup and the controls and terms to confirm before rollout.
// DATA HANDLING
Understand what your chat collects and keeps.
Content your chat uses
Start with public FAQs, product information and other material your customers are meant to see. Keep credentials, internal notes and unnecessary personal information out of the knowledge base.
Conversation data
Customer messages may contain personal information. Review what is collected, which services receive it, and who can access transcripts before enabling a channel.
Storage & retention
Confirm the hosting region, retention period and backup policy for your deployment. Include exports, deletion requests and backup copies in that review.
AI processing
Check which model provider and account settings apply to your setup. Review training, retention and regional processing terms before sending business or customer content.
// ACCESS & AUTHENTICATION
Give the right people the right access.
Operator permissions
Define who can view conversations, update content and administer integrations. Review account roles and instance boundaries with the team that will run the chat.
Sign-in requirements
Tell us which authentication controls your organization requires. Confirm available sign-in, multi-factor and single sign-on options for the proposed setup before rollout.
Logging & offboarding
Agree which actions need to be logged, how long logs are kept and who can review them. Include account removal and credential revocation when staff or vendors leave.
// ENCRYPTION & CREDENTIALS
Review protection across the data path.
Data in transit
Review the connections between visitors, the chat service, operators and enabled integrations. Confirm the transport security settings for each part of the data path.
Stored data
Include databases, uploaded files and backup copies in your encryption review. Confirm how encryption keys are stored, accessed and managed for the deployment.
Integration credentials
Review how API tokens and service credentials are stored and who can access them. Define ownership, rotation and revocation before connecting production accounts.
// YOUR REQUIREMENTS
Match the setup to your requirements.
Privacy & processing terms
Review the Privacy Policy and the terms that apply to your setup. Raise data-processing, residency and deletion requirements before sharing personal information.
Privacy PolicyRegulated data
Do not assume a deployment is suitable for health or other regulated data. Discuss the intended use, required safeguards and contractual requirements with our team and your advisers first.
Discuss your requirementsProcurement evidence
If your review requires certifications, audit reports, a DPA or a BAA, tell us up front. Confirm what evidence and agreements are available for the proposed deployment.
Send your questionnaire// OPERATIONAL SECURITY
Plan for the work after launch.
Updates & dependencies
Review who maintains the software, how vulnerabilities are prioritized and how updates are tested. Confirm any patching commitments in the applicable service terms.
Backup & recovery
Define what needs to be backed up, how long copies are kept and how restores are checked. Agree recovery expectations before the chat becomes part of daily operations.
Access reviews
Plan how permissions, inactive accounts and integration access will be reviewed. Assign responsibility for removing access that is no longer needed.
Incident coordination
Confirm the security contact, escalation path and notification responsibilities for your setup. Agree the process and any response commitments in writing rather than assuming a standard timeline.
// SERVICE PROVIDERS
Know which services are in your data path.
The services involved depend on the channels and integrations you enable. Request the current provider list for your setup, including data shared, processing regions, retention and applicable agreements.
AI services
An enabled AI provider may receive conversation context and knowledge-base content to generate a reply. Check the account's processing and retention terms.
Hosting & storage
Review the application host, database, file storage and backup services together. Confirm where each copy is stored and how access is controlled.
Messaging channels
Each enabled messaging channel adds its own service provider and account terms. Review the connection method and the data that moves through that channel.
Email services
Check which provider delivers notifications, password resets or other transactional messages, and which recipient and message details it receives.
SMS verification
If SMS is enabled, review the carrier or messaging provider and whether it handles authentication codes, customer messages or both.
Edge & network services
Include DNS, content delivery and traffic protection services in the review. Confirm what request information they process and retain.
Location tools
Location-aware features may involve an external maps or weather provider. Review which locations and query details are shared before enabling them.
Optional content tools
Review optional image or content services separately from the chat runtime. Confirm whether they are enabled and what content is sent to them.
// REPORT AN ISSUE
Found a security issue? Report it directly.
Send a focused report
Email genius@restontechwiz.com with the affected URL, what you observed and steps to reproduce it. Please avoid including credentials or customer records.
Disclosure details
The public security.txt file lists the vulnerability-reporting contact and disclosure details. Refer to it when preparing your report.
Have a security requirement we should review?
Send your questionnaire, required controls or approved-provider requirements to security@chatgenius.net. Share the requirements, not passwords, API keys or live customer records.