Panelbotdocs
SearchStart free

Data handling and privacy

What Panelbot stores and what it never logs: encrypted credentials, careful handling of chat content, and your right to export or delete data.

What we hold, and what we refuse to

Good privacy is mostly about restraint: collecting only what a job needs, protecting what you keep, and being honest about both. This page describes what Panelbot stores to do its work, what it goes out of its way not to store, and the rights you have over all of it.

What Panelbot stores

To help your customers, Panelbot keeps a modest set of records:

  • Your configuration. The settings for your account, your servers, your team, your chat widget, and the connection to your billing portal.
  • Service records from your billing portal. So Panelbot knows which customer owns which domain or account, it keeps a synced copy of your service list. This is the information ownership checks read from.
  • Session and audit records. A record of each support conversation and each action taken on your servers, including diagnostic checks, changes, approvals, and requests that were declined.

These records exist so you can review what happened, hold the system accountable, and export the history whenever you want it.

What Panelbot deliberately does not log

Some data is too sensitive to sit in a log file, so it never gets written to one. Panelbot does not log:

  • Passwords, security keys, or the credentials for your billing portal.
  • The tokens that authenticate your customers, the panel credentials for your servers, or the optional server agent.
  • Full payment card numbers.
  • The bodies of customer emails.

This is a deliberate boundary, not an afterthought. Secrets are also kept out of error messages and out of any response sent back through the interface. If a value is sensitive, the design assumes it should never be echoed, printed, or stored in the clear.

Encryption at rest and in transit

Sensitive stored values, such as your billing portal credentials, are encrypted at rest. They are decrypted only at the moment they are needed for an operation, then dropped. The keys that let Panelbot authenticate to your server are stored in a protected form, never as plain text you could read back.

Everything that moves between your customer, Panelbot, and your servers travels over authenticated, encrypted channels. Instructions to your server are cryptographically signed and scoped to your account, so a message cannot be forged or pointed at the wrong machine.

Customer chat content is treated as untrusted

Anything a customer types is treated as untrusted input. The assistant reads a message to understand it and to pull out relevant details, but nothing the customer writes is allowed to become a command, override a permission, or decide who owns what.

Every conclusion drawn from a chat is checked against trusted records before anything acts on it. If a customer claims ownership of a domain, that claim is verified against your synced service list, not accepted because it was stated confidently. This means a customer cannot talk Panelbot into touching an account they do not own, no matter how the message is worded. Chat content informs the conversation; it never makes a security decision.

Where customer identity comes from

Panelbot does not run its own customer logins. When a customer opens the chat from your billing portal, your portal vouches for who they are with a secure token, and Panelbot trusts that identity for that session only. From there, the customer can see and act on their own services, and nothing else. Panelbot never exposes one customer’s data to another, and the assistant never sees data belonging to a customer other than the one it is currently helping.

When your staff can view a conversation

Your support team can view the conversations that happen through your widget, because those are your customers and your business. Reviewing a chat transcript and its diagnostic context is part of taking over a case when a human is needed. This access is limited to your own account’s conversations and is itself recorded, so there is always a trail of who looked at what.

Your data is yours: export and deletion

The records tied to your account belong to you. You can ask us for an export of your account data. We run it for you, and it covers your account and user records, servers and agents, integration settings (without credentials), command and action history, AI usage records, and your audit log. You can also download your audit log as a CSV from the dashboard at any time (the export covers the most recent 10,000 entries that match your filter). You can request deletion too, and we honor deletion requests for your account’s data.

Audit records cannot be edited or deleted through the product, so individual history entries are never quietly changed; the record stays trustworthy precisely because no one can rewrite it after the fact. Audit records are kept for 12 months and chat transcripts for 90 days, then removed automatically. Deletion applies to your account’s data as a whole when you ask us to remove it, not as a way to erase selected events from the record.

What we do not claim

We describe our data practices in plain, checkable terms. We do not claim formal certifications or compliance seals we have not earned, and we would rather tell you exactly what the system does than wave a badge. If you have a specific regulatory requirement, ask us directly and we will tell you honestly where we stand.