> ## Documentation Index > Fetch the complete documentation index at: https://sitegpt.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Security and data handling > What SiteGPT does with your data, how you control it, and where to get compliance documents. This page explains what SiteGPT does with the data in your account, which controls you have over it, and where to find documents for a security review. The public legal pages describe the standard terms. If you signed a DPA with SiteGPT, your signed DPA controls. This page links to the public pages. ## Certifications and public commitments SiteGPT's public [security questionnaire](https://sitegpt.ai/legal/security-questionnaire) states: * **SOC 2 Type II:** SiteGPT completed a SOC 2 Type II examination. It covers security, availability, and confidentiality. Enterprise customers can request the report through the [trust portal](https://trust.sitegpt.ai). * **GDPR:** SiteGPT is GDPR certified by DPLMC International. * **HIPAA:** SiteGPT was assessed for HIPAA compliance by DPLMC International. A Business Associate Agreement (BAA) is available on the Enterprise plan. See [HIPAA](/docs/account/hipaa). * **ISO 27001:** SiteGPT does not hold an ISO 27001 certification. * **Encryption:** all data is encrypted in transit with TLS 1.2 or higher, and at rest. * **Hosting region:** data is stored with the vendors on the [subprocessor list](https://sitegpt.ai/legal/subprocessors), mostly in the United States. SiteGPT does not offer EU-only hosting. ## Who controls the data For the content your chatbots learn from, the conversations they have, and the leads they collect, you are the controller. SiteGPT processes that data for you, on your instructions. This is stated in the [privacy policy](https://sitegpt.ai/legal/privacy). ## How your data is kept apart * **Each chatbot has its own content.** When a chatbot looks for an answer, it searches only the content added to that chatbot. Content is not shared between chatbots or between customers. * **Access is per chatbot.** People see a chatbot only if they own it or are a member of it. Each member has a role: Agent, Manager, Admin, or Super Admin. The role controls who can see conversations, change content and settings, and manage members. See [Team members](/docs/guides/account/team-members). * **Billing is per person.** Members do not see the owner's plan or billing. ## How AI providers use your data SiteGPT uses outside AI services to read content and write answers. The [subprocessor list](https://sitegpt.ai/legal/subprocessors) names them. It includes OpenAI for language model processing, Cohere for embeddings, Pinecone for vector search, and Context.dev for parsing uploaded files. Requests to OpenAI go through the Portkey gateway. * SiteGPT does not use your content or conversations to train AI models. SiteGPT's AI providers process this data under their data processing terms, which also set how long they keep it. In HIPAA workspaces, OpenAI processing uses zero-data-retention endpoints. SiteGPT still stores conversations and other records under its own retention rules. See [HIPAA](/docs/account/hipaa). ## How long SiteGPT keeps your data On standard accounts with an active subscription, SiteGPT does not delete your chatbots or their data on a schedule. Chatbot content, conversations, and leads stay until you delete them, or until you delete the chatbot or your account. If you cancel your subscription and it ends, SiteGPT schedules your chatbots and their data (conversations, documents, and leads) for deletion no earlier than 30 days after the subscription ends. At least seven days before the deletion date, SiteGPT emails the account owner that date. To keep your chatbots, subscribe again before that date. Billing records stay after account deletion, as tax and accounting law requires. HIPAA workspaces are different: conversation content is redacted automatically. See [HIPAA](/docs/account/hipaa#retention-and-redaction). ## What you can delete Each deletion is permanent. You cannot undo it. | What | Where | What is removed | | ------------------------ | -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Conversations | **Chat History** | The selected conversations. See [Delete conversations](/docs/guides/monitor/review-conversations#delete-conversations). | | A lead | The lead's page | The contact details in that lead. The conversations stay. See [Manage leads](/docs/guides/leads/manage-leads). | | All data for one visitor | **Delete all visitor data** on the lead, or **Delete Visitor Data** in the conversation menu | Every conversation that visitor had with the chatbot, their lead, and their visitor identity. Data you already sent to connected tools, such as a helpdesk or CRM, is not touched. See [Manage leads](/docs/guides/leads/manage-leads). | | Content | **Website Links**, **Files & Data Sources**, **Text Snippets**, **Custom Responses** | The pages, files, snippets, or custom responses you remove. | | A chatbot | **Settings** > **General** | The chatbot with its content, conversations, leads, members, and custom responses. See [Delete a chatbot](/docs/guides/account/manage-chatbots#delete-a-chatbot). | | Your account | **Billing** > **Delete account** | Every chatbot you own, your memberships, and your profile. Cancel your subscription first. See [Delete your account](/docs/guides/account/sign-in-and-profile#delete-your-account). | Before you delete, you can export conversations and leads to CSV. See [Export conversations to CSV](/docs/guides/monitor/review-conversations#export-conversations-to-csv) and [Export leads to CSV](/docs/guides/leads/manage-leads#export-leads-to-csv). For a deletion or export that you cannot do in the dashboard, email [support@sitegpt.ai](mailto:support@sitegpt.ai). ## Sign-in and access keys * **Sign-in has no passwords.** You sign in with a link that SiteGPT sends to your email. The link works for 1 hour. There is no Google or other social sign-in. Anyone who can read your inbox can sign in as you, so protect your email account. See [Sign in and profile](/docs/guides/account/sign-in-and-profile). * **API tokens** are shown only once, when you create them. SiteGPT stores only a hash of each token. Give each token only the scopes it needs. You can rotate or revoke a token at any time. See [Authentication](/docs/developers/authentication). * **Webhook tokens** are secrets that SiteGPT sends with each webhook delivery, so your endpoint can check the sender. They stay visible in **Settings** > **Webhooks**. If a token leaks, change it there. See [Webhooks](/docs/developers/webhooks). ## What the widget collects from visitors * The widget stores the messages in each conversation. * It collects contact details only when you turn on a [lead form](/docs/guides/leads/collect-leads). * [Tracking events](/docs/developers/tracking-events) that go to your analytics tools contain IDs and event names. They contain no name, email, phone number, or message text. * To ask visitors to accept your terms, or to show a notice below the chat, see [Add a disclaimer and consent](/docs/guides/answers/add-disclaimer-and-consent). ## Documents for a security review | Document | Where | Notes | | ------------------------------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Trust portal | [trust.sitegpt.ai](https://trust.sitegpt.ai) | Enterprise customers can request the SOC 2 report here. | | Security questionnaire | [sitegpt.ai/legal/security-questionnaire](https://sitegpt.ai/legal/security-questionnaire) | Standard answers for vendor and procurement reviews. | | Subprocessor list | [sitegpt.ai/legal/subprocessors](https://sitegpt.ai/legal/subprocessors) | To get change notices by email, send an email to [privacy@sitegpt.ai](mailto:privacy@sitegpt.ai) with the subject "Subscribe: subprocessor updates". | | Data Processing Agreement (DPA) | [sitegpt.ai/legal/dpa](https://sitegpt.ai/legal/dpa) | You can download a copy with your company details. SiteGPT signs DPAs with Enterprise customers during onboarding. On other plans, the data processing terms are in the [Terms and Conditions](https://sitegpt.ai/legal/terms). | | Privacy policy | [sitegpt.ai/legal/privacy](https://sitegpt.ai/legal/privacy) | How SiteGPT collects and uses personal data. | | BAA | [sitegpt.ai/legal/baa](https://sitegpt.ai/legal/baa) | Enterprise plan only. See [HIPAA](/docs/account/hipaa). | If your review needs signed documents, more detail, or a call, email [support@sitegpt.ai](mailto:support@sitegpt.ai). For data protection questions, email [privacy@sitegpt.ai](mailto:privacy@sitegpt.ai).