Owentra sits on your website and talks to your customers, so how we handle conversations and data matters. This page is a plain-English summary of the security controls built into the product today, how we process data, who our sub-processors are, and where we stand on formal compliance. We would rather tell you exactly what is and isn't in place than imply certifications we don't yet hold.
Your conversations are answered on Owentra's own AI infrastructure — not sent to a third-party AI vendor. The assistant runs on a self-hosted large language model, so visitor messages and your business knowledge are processed within our environment by default rather than shipped off to an external model provider.
A clearly-scoped commercial model (xAI Grok) is configured only as an optional fallback for continuity if the primary self-hosted model is temporarily unavailable. It is used solely to generate a reply in that moment and not to train any model. If you require self-hosted-only processing with no third-party fallback, contact us — it can be enforced for your workspace.
Your assistant answers only from the knowledge you give it — your website content and any documents you upload. It is instructed not to draw on general pre-trained knowledge, and to say it doesn't know rather than guess.
Each assistant can run in Standard or Strict mode. In Strict mode, every AI answer is checked against your own knowledge before it reaches the visitor, and anything that can't be verified is withheld in favour of a safe "I don't have that information" response (with a handoff offer where enabled). Strict mode is recommended for regulated or high-trust use cases.
Sensitive credentials you store — custom SMTP passwords and action (webhook) API keys — are encrypted at rest, not held in plain text.
Leads can be confirmed with an email one-time passcode (OTP) before they enter your pipeline, so contacts are real and reachable.
Custom actions that call your endpoints are guarded against server-side request forgery (SSRF): requests to internal, loopback and cloud-metadata addresses are refused.
Data returned by your external actions is treated strictly as untrusted content and neutralised so it can't hijack the assistant's instructions.
Traffic to the app and the chat widget runs over HTTPS/WSS, and the embed widget is served with no-cache controls so updates apply cleanly.
Feature entitlements are re-checked server-side on every use, so access can't be forged from the browser.
You own your data. Conversations, leads and tickets captured through your assistants belong to your workspace, and we process them to provide the service — we do not sell your data or your visitors' data.
We use a small number of vendors to run the service. Each processes only what it needs for its function.
| Sub-processor | Purpose | Data involved |
|---|---|---|
| Cloud hosting / infrastructure | Runs the application, database and AI model | All service data (processed within our environment) |
| Razorpay | Subscription billing & payments | Billing contact & payment metadata (card data handled by Razorpay, not stored by us) |
| xAI (Grok) | Optional AI fallback only | Conversation text, only when the primary model is unavailable; can be disabled per workspace |
| Email delivery (your SMTP or ours) | OTP, ticket & notification emails | Recipient email & message content; you may configure your own SMTP |
We'll keep this list current. Material changes to sub-processors will be reflected here.
Being straight with you about where we are:
If you believe you've found a security issue, please email team@owentra.com with details and steps to reproduce. We appreciate responsible disclosure and will acknowledge your report. Please don't publicly disclose an issue before we've had a chance to address it.
Questions about security or data handling? Email team@owentra.com. See also our Privacy Policy and Terms of Service.