What it can reach, and what it cannot

The useful questions are concrete: what can the bot reach, what do we store, and what keeps one customer's conversations separate from another's? These are the answers, including where the controls stop.

A standard hosted bot has no tools

For a standard hosted site, your Context and the conversation go in and text comes out. The bot has no shell, filesystem or general web access. It cannot browse another customer's data because that capability is absent, not merely forbidden by an instruction.

Hosted Enterprise is the explicit exception: you may configure one MCP context tool that you operate. The bot can call that tool and no other; it still receives no shell, filesystem or general browser.

How conversations stay separated

Every conversation is stored under a key built from the site id and the conversation id, both fixed by us rather than chosen by the caller. A site cannot name another site's conversation because it cannot name a site id it was not issued.

Conversation ids are signed, so a visitor cannot guess or edit one into somebody else's chat.

Your key is public; your domains are the control

The key is in your page source by necessity. In a browser, a request carrying it from a domain you did not list is refused. Another account cannot claim a domain you already serve, though two bots on your own account may share it.

Origin is a browser control, not proof against an arbitrary API client: non-browser software can forge that header. Leave no-origin access off unless you are deliberately supporting a mobile app, and require app installs to register when you do.

What we can see

We can read the conversations on your sites — they are stored on our hardware, unencrypted at rest, and support would be pretence otherwise. They are removed by the hosted service's periodic retention sweep. Deleting a bot invalidates its key immediately but does not immediately erase stored conversations or captured leads.

We do not use your conversations for model training. The hosted model is an open-weights model running on our hardware, and your text is used only to answer the conversation.

Where the model runs

On our own hardware. We do not send your visitors' messages to OpenAI, Anthropic, Google or another third-party model provider for inference. Transcript email, a customer-configured Enterprise MCP tool and the infrastructure needed to deliver the Service are separate data paths described in our Privacy Notice.

The limits of a persona

Instructions that tell the agent what not to say are strong but not absolute. A determined visitor can sometimes talk a model around. We test ours against exactly that — impersonation, "ignore your instructions", claiming to be the site owner, asking it to repeat its prompt — and design it to refuse. But we will not call that protection absolute, because instruction-level protection is not.

This is why the important boundaries are structural rather than instructional. Do not put a secret in Context and rely on a Guardrail to keep it in; anything the agent knows, treat as something a visitor could eventually read.

What we will not claim

We hold no compliance certification — not SOC 2, not ISO 27001, not HIPAA. If your procurement requires one, we are not a fit today and we would rather say so now than during a questionnaire.

If the requirement is that data must not leave your network at all, the hosted service is the wrong shape and running it yourself is the right one.

Reporting something

If you find a security problem, email security@kavilo.cloud. We will confirm receipt, and we would rather hear about it awkwardly than not at all.