Articles / Security

Security guide

AI Chatbot Security and Privacy: A Practical Checklist

A website chatbot should only have access to the information it needs to help a visitor. Security starts with deciding what it may know, what it must never reveal and when it should hand the conversation to an authenticated process or person.

Set data boundaries first

Use public, approved business knowledge for a public website assistant. Do not mix internal material, customer records, credentials or private operational documents into a source simply because they are available. If a workflow needs account-specific information, it needs the right authentication and authorisation model—not a public chat response.

Use this launch checklist

• Inventory every connected source and remove stale or sensitive material.
• Minimise the personal data requested in chat and explain why it is needed.
• Limit staff access to settings, transcripts and integrations by role.
• Define responses for sensitive topics and suspicious requests.
• Review logs, source changes and handoff rules on a regular cadence.

Design for safe uncertainty

Tell the assistant not to guess, disclose system instructions or provide answers outside its approved scope. It should be comfortable redirecting visitors to a secure channel or a human. This is not only a technical control—it is a customer-trust decision.