← Owentra home Privacy Terms

Trust & Security

Last updated: August 2026 · Version 1.0

Owentra sits on your website and talks to your customers, so how we handle conversations and data matters. This page is a plain-English summary of the security controls built into the product today, how we process data, who our sub-processors are, and where we stand on formal compliance. We would rather tell you exactly what is and isn't in place than imply certifications we don't yet hold.

1. How your AI conversations are processed

Your conversations are answered on Owentra's own AI infrastructure — not sent to a third-party AI vendor. The assistant runs on a self-hosted large language model, so visitor messages and your business knowledge are processed within our environment by default rather than shipped off to an external model provider.

A clearly-scoped commercial model (xAI Grok) is configured only as an optional fallback for continuity if the primary self-hosted model is temporarily unavailable. It is used solely to generate a reply in that moment and not to train any model. If you require self-hosted-only processing with no third-party fallback, contact us — it can be enforced for your workspace.

Your assistant answers only from the knowledge you give it — your website content and any documents you upload. It is instructed not to draw on general pre-trained knowledge, and to say it doesn't know rather than guess.

Answer Trust Mode

Each assistant can run in Standard or Strict mode. In Strict mode, every AI answer is checked against your own knowledge before it reaches the visitor, and anything that can't be verified is withheld in favour of a safe "I don't have that information" response (with a handoff offer where enabled). Strict mode is recommended for regulated or high-trust use cases.

2. Security controls in the product

Encryption of secrets

Sensitive credentials you store — custom SMTP passwords and action (webhook) API keys — are encrypted at rest, not held in plain text.

Verified lead capture

Leads can be confirmed with an email one-time passcode (OTP) before they enter your pipeline, so contacts are real and reachable.

Outbound request safety

Custom actions that call your endpoints are guarded against server-side request forgery (SSRF): requests to internal, loopback and cloud-metadata addresses are refused.

Prompt-injection handling

Data returned by your external actions is treated strictly as untrusted content and neutralised so it can't hijack the assistant's instructions.

Encrypted transport

Traffic to the app and the chat widget runs over HTTPS/WSS, and the embed widget is served with no-cache controls so updates apply cleanly.

Plan & access enforcement

Feature entitlements are re-checked server-side on every use, so access can't be forged from the browser.

3. Your data: ownership, export & deletion

You own your data. Conversations, leads and tickets captured through your assistants belong to your workspace, and we process them to provide the service — we do not sell your data or your visitors' data.

Export. Conversations, leads and tickets can be exported to CSV from your dashboard (on eligible plans).
Deletion / right to erasure. On request we can erase all stored data tied to a specific visitor (their conversations, messages, tickets and ratings). To request erasure for a visitor, or deletion of your workspace data, email team@owentra.com.
Retention. We can apply a configurable retention window so older conversation data is purged automatically. Talk to us if you need a specific retention period.

4. Sub-processors

We use a small number of vendors to run the service. Each processes only what it needs for its function.

Sub-processor	Purpose	Data involved
Cloud hosting / infrastructure	Runs the application, database and AI model	All service data (processed within our environment)
Razorpay	Subscription billing & payments	Billing contact & payment metadata (card data handled by Razorpay, not stored by us)
xAI (Grok)	Optional AI fallback only	Conversation text, only when the primary model is unavailable; can be disabled per workspace
Email delivery (ours during the free trial, your own SMTP on paid plans)	OTP, ticket & notification emails	Recipient email & message content

We'll keep this list current. Material changes to sub-processors will be reflected here.

5. Compliance status

Being straight with you about where we are:

GDPR / data-protection alignment In place
We support data-subject rights (access, export, erasure), publish this sub-processor list, and offer a Data Processing Agreement (DPA) to customers who act as data controllers. Request a DPA at team@owentra.com.
SOC 2 Type II On the roadmap
We are building toward a formal SOC 2 program. We're happy to share our current security practices under NDA in the meantime.
HIPAA Not yet — roadmap
Owentra is not currently offered as a HIPAA-compliant service and should not be used to process protected health information (PHI). Our self-hosted AI architecture puts us on a good footing to pursue this; contact us if it's a requirement.

6. Reporting a vulnerability

If you believe you've found a security issue, please email team@owentra.com with details and steps to reproduce. We appreciate responsible disclosure and will acknowledge your report. Please don't publicly disclose an issue before we've had a chance to address it.

Questions about security or data handling? Email team@owentra.com. See also our Privacy Policy and Terms of Service.