How we protect your data
Where the servers are, what is encrypted and how often we back up. This page only lists what is in place today, no plans.
At a glance
- Servers with netcup
- Germany
- Database backup to Frankfurt
- Every 5 minutes
- for credentials
- AES-256
- Target for breach notices
- 24 hours
Last checked: October 19, 2026
Servers
Located in Germany
Conversations, knowledge and settings are stored on our servers with netcup in Germany.
Server access by key only
Only someone holding the matching digital key can log in to the servers. There is no password login there, so guessing passwords gets nobody anywhere.
Database not reachable from the internet
The firewall blocks access to the database from outside. Only our own systems can reach the data.
Connections
Encrypted connections only
Every connection to webchatagent.com uses HTTPS, and current browsers use TLS 1.3 for it. Anyone typing http:// is redirected, and the browser remembers for two years to use HTTPS only (HSTS).
Cloudflare in front of webchatagent.com
Requests to webchatagent.com, meaning the website, the dashboard and the chat window, pass through Cloudflare, which stops attacks before they reach our servers. White-label platforms on a customer’s own domain connect to our servers directly, without Cloudflare.
Passwords and credentials
Credentials encrypted
Credentials for connected services such as WhatsApp, Instagram, email inboxes, calendars, Notion or Confluence are stored encrypted (AES-256-GCM). The same goes for the addresses and keys of your own interfaces (API and MCP connections).
Passwords never stored readable
We don’t store your password itself, only a check value derived from it (scrypt). The password can’t be calculated back from it, not even by us.
No card data on our side
You enter payment details directly with Stripe. Card numbers never reach our servers.
Accounts and permissions
Confirmed email address
An account with a password only works once its email address is confirmed.
Two-step login
If you want, login also asks for a 6-digit code from an app on your phone, including when you sign in with Google. Whenever it is switched on or off, you get an email.
Protection against password guessing
After too many wrong passwords in a row, login is blocked for up to 15 minutes. For the 6-digit codes the block kicks in after just 5 failed attempts.
Permissions per team member
Each team member signs in with their own login. You decide which areas they see, such as live chat or collected contacts, and for which chatbots.
Backups
Database backed up continuously
Every 5 minutes the latest state of the database goes to Google Cloud in Frankfurt. If something goes wrong, we can bring the database back to a specific minute, at least within the last 24 hours.
A full backup every night
Every night the server backs up all databases and files and uploads them to Google Cloud in Frankfurt, a different location from our servers.
The server can’t delete backups
The account the server uploads with may store backups but can neither delete nor overwrite them. Even someone who takes over our server can’t destroy a backup with it.
Deleted after 3 days
Google Cloud deletes older backups automatically, after 3 days at the latest. Deleted data doesn’t linger in old copies for months.
Restore rehearsed
On October 16, 2026 we restored all databases from a backup onto an empty server. On October 19, 2026 we also brought the database back to a specific minute.
Retention
Deleted automatically after 30 days
For new accounts we delete conversations, calls, collected contacts and appointments after 30 days. You set the period yourself in the settings.
Uploads gone after 7 days
Files and images that visitors send in the chat are deleted after 7 days.
No AI training
We don’t use conversations or your website content to train AI models.
If something goes wrong
Notice within 24 hours as the target
If there is a data breach, we inform you without delay. Our target: within 24 hours of finding out. That’s what the DPA says.
99.9% availability as a target
We aim for 99.9% availability on an annual average. That’s a target, not a guarantee: fixed commitments with credits only apply if we agree on them separately in writing.
Security questions
With netcup in Germany. The backups are stored with Google Cloud in Frankfurt. For each answer, the question also goes to the AI model you picked; where it runs depends on the provider.
No. Only requests to webchatagent.com pass through Cloudflare. A white-label platform on your own domain connects to our servers directly, also encrypted via HTTPS.
Yes. Once two-step login is on, we ask for the code from your app after a Google sign-in as well. Switching it on needs your password; if your account has none, you sign in again once instead.
Not in the standard contract. We aim for 99.9% availability on an annual average. Fixed commitments with credits are only agreed separately and in writing.
In the annex “Technical and Organizational Measures (TOMs)” of our data processing agreement (DPA). You can read the DPA on our website before you sign up.
Email us at hello@webchatagent.com. Briefly describe what you found and how to reproduce it.
Ready? Create your first AI chatbot.
Free to start, no payment details needed. Cancel anytime.
No credit card required. Cancel anytime.