Security & Trust

Built with security from the ground up

SiteYak handles real visitor conversations and indexes your website content. Here's exactly how we protect your data and your visitors' privacy.

Five layers of protection

01

Data transmission encryption

All data in transit between your visitors, the SiteYak widget, and our API is encrypted using TLS 1.2 or higher. We do not accept unencrypted connections.

02

Data storage and isolation

Your site's indexed content, conversation logs, and configuration are logically isolated per site. No data is shared across customer accounts.

03

AI processing

Visitor questions and the page content used to answer them are sent to our AI providers over encrypted connections and processed to generate a reply. Our providers do not use this data to train their models, and SiteYak does not use your conversations to train any model.

04

Access controls

Your dashboard is protected by an email and password or a one-time sign-in link. Sessions are held server-side, expire after 30 days or 7 days of inactivity, and can be revoked immediately — changing your password signs out every other device. Production database access is restricted to authorized team members.

05

Third-party dependencies

SiteYak uses a small set of established third-party services: OpenAI and Anthropic (AI), Railway (hosting and database), Stripe (billing), Resend (email), and Cloudflare (CDN, network and bot protection).

Your data

What we store

  • The text content of pages you index
  • Visitor chat messages and AI responses
  • Conversation counts for billing purposes
  • Your site's branding and configuration
  • Your email address and a one-way hash of your password — never the password itself

What we don't store

  • Visitor IP addresses or device identifiers
  • Payment card details (handled by Stripe)
  • Your password in readable form
  • Data from pages you haven't chosen to index

Data retention

  • Conversation logs: retained while your site is active — ask us to delete them
  • Indexed content: retained until you delete the document
  • Site configuration: retained until you ask us to delete your account
  • Sign-in sessions: expire after 30 days, or 7 days unused
  • Billing records: retained as required by law

AI providers

Two AI providers process visitor messages. When a visitor asks a question, OpenAI's embedding API converts it into a numeric form so SiteYak can find the relevant pages of your site, and Anthropic's Claude API writes the answer from those pages. Apart from our hosting and network providers (Railway and Cloudflare), no other third party handles conversation content.

Both providers state that data submitted through their APIs is not used to train their models. SiteYak does not use your conversations to train any model. See OpenAI's API data usage policy and Anthropic's Privacy Center.

Your responsibilities

As a SiteYak customer, you agree to use the service responsibly. Key obligations:

  • Keep your sign-in credentials confidential.

  • Do not index pages containing sensitive personal data (passwords, payment card numbers, private health information).

  • Ensure your own website's Terms of Service permit automated crawling and AI-powered responses.

  • Configure your monthly conversation cap to limit unexpected usage.

  • Report any suspected misuse or security concerns promptly.

Full details are in our Terms of Service.

Reporting a security concern

If you discover a potential security vulnerability or have concerns about how SiteYak handles data, please contact us immediately. We take all reports seriously and will respond within 48 hours.

security@siteyak.ai

Please include as much detail as possible: the affected URL or feature, steps to reproduce, and the potential impact. We ask that you give us reasonable time to investigate before public disclosure.

Questions about security? Email security@siteyak.ai