Security depends on how you configure, publish, and operate your chatbot. This guide covers practical controls visible in the product frontend; it is not a certification or compliance statement. Review the current security page and your organization's requirements before handling sensitive information.
Protect credentials and endpoints
Keep API keys and access tokens on trusted servers, store webhook secrets securely, and rotate credentials after exposure or staff changes. Use HTTPS for webhook destinations and validate webhook signatures using the protocol confirmed for your account.
Restrict widget allowed domains to approved hosts when the control is available. Domain restrictions do not protect server credentials or replace authorization checks on your own backend.
Review data before publishing
Only add source material approved for the audience that will use the chatbot. Remove credentials, personal data, internal notes, and confidential documents unless their use has been reviewed and authorized. Test answers for disclosure, unsupported claims, and correct escalation to a human.
Do not assume a product feature establishes regulatory compliance. Review applicable privacy notices, data handling, contractual obligations, and security requirements with the responsible team.
Example server-side secrets
PRIMEWEBKIT_API_URL=https://api.primewebkit.com/api/v1 PRIMEWEBKIT_ACCESS_TOKEN=<store-in-your-secret-manager> PRIMEWEBKIT_WEBHOOK_SECRET=<store-in-your-secret-manager> # Do not prefix public frontend variables with NEXT_PUBLIC_ for secrets.
Verify and allow only intended widget hosts
{
"allowed_domains": ["example.com", "www.example.com"]
}Frequently asked questions
Is this a compliance certification?
No. This guide is operational guidance and does not claim a security certification, regulatory compliance, or a particular legal status.
Where can I find PrimeWebKit security information?
Visit the security page at /security for the product's current security information.
Should I put an API key in the widget script?
No. Never put a private API key or account token in a public script, HTML page, or browser bundle.
Read the PrimeWebKit security page for current product security information.