Security
The widget runs on other people's websites and answers questions from untrusted visitors, so several layers exist to keep that safe.
Domain locking
Your site key is public, but only works from origins on your allowlist. Rotating the key invalidates every existing embed immediately.
Conversation guardrails
Every visitor message passes through, in order:
- Session cap — 50 messages, then the conversation must be restarted.
- Length cap — oversized messages are declined politely.
- Prompt-injection filter — common attempts (“ignore previous instructions”, “reveal your system prompt”) are blocked before reaching a model, and the reply gives no sign a filter fired.
- Topic keywords — if configured, off-topic messages get your fallback without an AI call.
- Retrieval thresholds — weak matches are discarded rather than used as evidence.
The first four are deterministic code. Grounding instructions in the prompt are strong but, being instructions to a model, are not an absolute guarantee.
Tone
Every refusal path — session limit, daily limit, off-topic, injection, provider error — returns a courteous message. Operator-written fallbacks are softened automatically if they read as blunt, since the widget speaks for your brand.
MCP safety
Connecting an external server introduces two risks, both handled:
- SSRF. You supply a URL that Minaya's servers fetch, so private ranges, loopback, link-local, CGNAT, and cloud metadata endpoints are rejected — checked at save time and again before each connection, defeating DNS rebinding.
- Tool poisoning. Tool names and descriptions come from a server you control but Minaya does not. Metadata is sanitised, hidden characters stripped, instruction-like tools dropped, and results labelled as data rather than instructions.
Safe rendering
Replies are rendered as DOM nodes, never by parsing HTML. Links, lists, and bold text are constructed programmatically, so content summarised from a third-party page cannot inject markup into a customer's site. External links carry rel="noopener noreferrer".
Data handling
- API keys — encrypted at rest, never returned in full.
- MCP tokens — encrypted at rest, never returned.
- Transcripts — stored per session and scoped to your business.
- Deleting a source — removes its chunks and embeddings immediately.
See the privacy policy for the full picture, and MCP integration for connection details.