Boring, in the way security should be
Sitora holds content businesses already publish, plus the conversations their customers choose to have. Here is how we treat it.
Encryption in transit and at rest
All traffic is TLS. Stored content, conversations, and leads live in encrypted managed databases in US regions.
Credential handling
Passwords are hashed with scrypt and never stored or logged in plain text. Sign-in with Google is available so you can avoid a password entirely. Sessions are signed and expire after 30 days.
A polite, bounded reader
Our reader identifies itself as SitoraBot, only fetches public pages over http and https, never executes site scripts, never attempts logins or forms, and stays within small documented page caps.
Least access
Production access is limited to the engineers who operate the system, behind hardware security keys. Support can only see your data when you share a conversation with us.
Abuse limits everywhere
Every public endpoint is rate limited per IP, message sizes are capped, and agent volume is metered per account server-side, so one bad actor cannot spend your plan or our models.
Model providers see content, not identity
When a model provider is used to compose an answer, it receives the retrieved site passages and the visitor's question, and nothing about the visitor's identity. Providers are contractually barred from training on this data.
Found something?
Report vulnerabilities to security@getsitora.com. We confirm receipt within one business day, keep you updated while we fix, and credit you if you want credit. No legal action against good-faith research.