Skip to main content

Security

Last updated: 19 August 2026

This page describes how we protect your data, and the data your visitors share with your chatbot. It is written to be specific: every statement below describes a control that is actually in place.

Where your data is stored

All platform data — your account, your chatbot configuration, your knowledge base and your conversations — is stored on servers in the United Kingdom.

Traffic reaches us through Cloudflare, which terminates TLS and provides a web application firewall and DDoS mitigation, with UK and EU visitors served from local edge locations.

Every third party that processes data on our behalf, and the country each one operates in, is listed on our sub-processors page. We give at least 14 days’ notice before adding or replacing one.

Encryption

In transit. Every request is served over TLS 1.2 or 1.3. HTTP Strict Transport Security is enabled, so browsers refuse to connect over plain HTTP after their first visit.

Credentials and API keys. The credentials you give us for connected stores, together with our own third-party API keys, are encrypted at rest using AES-256-CBC with an HMAC-SHA256 authentication tag (encrypt-then-MAC), so a modified ciphertext is rejected rather than decrypted.

Passwords. Account passwords are hashed with bcrypt and are never stored or recoverable in plain text. Password-reset, verification and remember-me tokens are stored as SHA-256 hashes, so the values in our database cannot be replayed.

Payments

Payments are handled by Stripe Checkout, which is hosted by Stripe on their own domain. Card numbers, expiry dates and security codes never reach our servers and are never stored by us. Stripe is certified to PCI DSS Level 1, the highest level defined by the standard.

We retain only what we need to service your account: Stripe customer and subscription identifiers, amounts, and an opaque card fingerprint supplied by Stripe that lets us detect fraud without revealing the card number.

Access to your account

  • Two-factor authentication (TOTP) is available on customer, partner and administrator accounts, with single-use backup codes.
  • Rate limiting is applied to sign-in, password reset, registration and the chatbot API, with automatic blocking of abusive addresses.
  • Administrative actions are recorded in an append-only audit log.
  • Sessions are cookie-based, HTTP-only and expire on inactivity; changing your password or your two-factor settings revokes remembered devices.

Your chatbot and AI providers

We use commercial, paid-tier AI APIs whose terms state that your prompts and responses are not used to train the provider’s models. Content retrieved from your website or connected stores is passed to the model inside an explicit boundary marker and treated as untrusted data, so instructions hidden in a web page cannot redirect your chatbot.

Visitor messages are screened for prompt-injection and abusive content before they are answered.

Your data rights

You can export everything we hold about you, or ask us to delete it, from your account at any time — no support ticket required. Account deletion runs on a 30-day grace period, so an accidental request can be reversed.

We publish a full Data Processing Agreement covering our role as your processor, and our Privacy Policy sets out the retention period for every category of data we hold. Retention is enforced automatically by scheduled jobs, not by hand.

Service status

Live availability of the platform and its dependencies is published on our status page.

Reporting a security issue

If you believe you have found a vulnerability, please email security@morv.ai. Our machine-readable contact details are published at /.well-known/security.txt in line with RFC 9116. We will acknowledge your report and keep you updated while we investigate, and we will not pursue action against researchers who report in good faith and avoid accessing other people’s data.