Security

The public web server defines a Content Security Policy to restrict permitted content sources. Its protection concerns the responses on which the policy is sent; it does not guarantee the absence of injection on every interface.

Frame restrictions protect the relevant public pages against unauthorized embedding. Authentication and expressly embedded interfaces may need different policies; a policy observed on the marketing site is not automatically the policy of a Customer’s calling interface.

HTTPS and transport-security headers protect the relevant served domain. Their scope must be verified for each deployed Customer domain; the company’s brand alone does not configure that protection.

The public server uses referrer and content-type protections to limit unnecessary referral information and content-type confusion. These controls complement, rather than replace, authentication and permissions.

Browser feature permissions depend on the page. A calling interface may require microphone access and a user’s browser permission; granting it is distinct from company access rights and from any legal requirement to inform call participants.

The current web client persists access-token state in the browser and uses an HttpOnly cookie for refresh. Browser storage is not described as exclusively server-side. The Cookie Policy explains the distinction between session access and data retention.

Session renewal and authorization flows maintain access within the granted scope. An OAuth connection does not grant authority to every company record or to any commercial purchase. Removing access and deleting previously imported data are distinct operations.

Public product information, authenticated company use and Customer-specific MCP interfaces have different access scopes. A public product assistant is not evidence that it can read company records. The commissioned interfaces must apply the relevant user and company permissions.

Making a legal document discoverable helps people find it. Indexing or a canonical URL is not a security control protecting business data, and an unindexed preview is not an authenticated private space.

MyBot undertakes appropriate access management and need-to-know controls for the agreed processing under the DPA. Specific measures and responsibilities belong in the project security description; no universal isolation guarantee or certification is inferred from this page.

Internal roles, assignments and explicit supervision determine access. Removing a collaborator’s authorization does not erase the company’s professional history. Administrators do not automatically have every right, and membership in several companies does not authorize sharing between them.

External or committing AI-prepared actions, including WhatsApp messages, require human validation within the relevant permissions. Internal memory updates and configured service messages follow their own rules. A sent notification is not proof that the underlying work succeeded or that the recipient read it.