Account protection
Chateor supports email verification, managed sessions, password protection, and two-factor authentication. These controls help teams verify identity, reduce unauthorized access, and review active account security.
Users should choose a strong unique password, enable two-factor authentication when available, protect recovery methods, and end sessions they no longer recognize or use.
Workspace roles and separation
Roles and permissions limit who can administer a workspace, manage users, access conversations, change settings, or control integrations. Workspace owners can grant access according to a person’s responsibilities and remove it when their role changes.
Customer workspaces are logically separated. Each organization remains responsible for reviewing membership, assigning the least access needed, and protecting any sensitive information it chooses to process.
API keys and signed webhooks
Chateor uses separately manageable API credentials so integrations can be revoked without changing a user password. Customers should store keys in a secure secret manager, avoid exposing them in browser code or logs, and rotate them if exposure is suspected.
Webhook deliveries can be verified with HMAC SHA-256 signatures. Consumers should validate the Chateor signature and timestamp headers before trusting an event. Technical requirements are documented in the Client API guide.
Operational accountability
Audit history and conversation records help authorized teams understand important workspace activity, ownership, and changes. Service diagnostics and security events support fault investigation, abuse prevention, and reliable operations.
Access to these records is governed by workspace permissions and applicable retention settings.
AI and knowledge controls
Chateor lets teams connect the materials they trust and define when an AI-assisted answer should transfer to a person. Source quality, permissions, review practices, and human handoff are essential parts of a secure and reliable deployment.
AI output may be inaccurate. Customers should avoid placing secrets in prompts or knowledge sources unless needed and authorized, review high-impact responses, and keep connected materials current.
Report a security concern
If you believe you found a vulnerability or suspect unauthorized access, contact Chateor through the support widget on chateor.com. Include a clear description, the affected area, reproduction steps when safe, and a way for us to follow up. Do not access data that is not yours or disrupt the Service while testing.