Security
Your content and your visitors, protected.
Glerora holds two kinds of sensitive data: the content your assistant learns from, and the conversations your visitors have with it. Here's how both are kept safe.
Platform and data
Hosted in the EU
Your workspace data - sources, indexed content, conversations and leads - is stored in a managed Postgres database in Frankfurt, Germany (Supabase, AWS eu-central-1).
Workspace isolation in the database
Row-level security policies on every table mean one workspace can never read another's data - enforced by the database itself, not only by application code.
Encryption
All traffic uses HTTPS/TLS, and the database is encrypted at rest. API keys you bring for OpenAI, Anthropic or Google are additionally encrypted with AES-256-GCM before they're stored.
Secure sign-in
Accounts use verified email with password, or Google and Microsoft sign-in. Sign-in uses the PKCE flow, and resetting a password signs out every other session.
Roles and permissions
Workspaces have owner, admin and member roles. Billing, API keys and integrations can only be changed by owners and admins.
Payments handled by Stripe
Card details go straight to Stripe and never touch Glerora's servers. Stripe's notifications are only accepted with a valid signature.
The assistant on your site
Domain allowlist
A published assistant only answers on the domains you approve. Requests from anywhere else are refused - including the page the widget is embedded in.
Rate limits
Chat is limited per visitor, per network and per assistant, so nobody can run up your usage or flood your inbox.
Prompt-injection guard
Crawled pages are treated as untrusted reference material: instructions hidden inside them are ignored, and the assistant only answers from your content.
Safe crawling
The crawler respects robots.txt, caps pages and sizes, and checks every URL and redirect so it can't be pointed at private or internal addresses.
You stay in control
Delete a source and its indexed content goes with it. Delete a workspace and everything inside it - assistants, sources, conversations and leads - is removed.
Glerora doesn’t use your content to train AI models. When the assistant writes an answer, the visitor’s question and the matching passages are sent to the AI provider you chose, only to generate that reply. Details are in our Privacy Policy.
Found a vulnerability?
Please report it privately to hello@glerora.com with the details and steps to reproduce. We’ll look into every report.