Security

YCbot is built so that the safest data is data we never hold. Here is how we protect the rest.

Hosted in Vietnam

Every part of YCbot runs on servers we operate in Vietnam: the chat, the admin, the storage, and the large language model that writes the answers. The live service never sends visitor messages to a foreign AI provider.

Encryption

• All connections to YCbot are encrypted.
• Conversations are stored encrypted, each with its own key. During a chat, only the visitor's own browser session can open it. Apart from that, a conversation can be read only through the admin: by the website owner's admins, or by Sonant staff when supporting that website.

Each customer's data stays separate

Each organization's websites, content and conversations are kept apart. An organization's admins see only their own websites.

Sign-in to the admin

• There is no public sign-up. Accounts are created by your organization's administrators.
• Admins can sign in with a passkey or an authenticator app code, and two-step sign-in can be required for everyone in your organization.
• Once an admin has set up a passkey or authenticator, a password alone is no longer enough to sign in.

We keep as little as possible

• No name, email address or IP address is stored with a conversation.
• Our web server logs, which do contain IP addresses, are kept for 7 days and never contain the text of messages.
• Conversations are deleted automatically after 90 days, or after the period the website owner sets.
• Visitors can delete their own conversation at any time.

Access by our staff

Only the Sonant staff who operate YCbot can reach its servers, and only to run and support the service.

If something goes wrong

If an incident affects personal data, we inform the affected customers without delay so they can report it to the authorities within the 72 hours the law requires, and we help them do so.

Report a problem

If you believe you have found a security problem in YCbot or this website, please write to hello@sonant.vn. We will reply, and we ask that you give us reasonable time to fix it before telling others.