Trust Center

Last updated: February 26, 2026

Foxchat is a lightweight live chat widget that routes website visitor conversations to your Slack workspace. This page covers our security architecture, data handling, and operational practices.

Architecture & Data Flow

How it works

  1. Visitor sends a message: The chat widget on your website connects to our backend over a secure WebSocket (WSS) connection authenticated by your project identifier.
  2. Backend processes and routes: The message is stored and posted to your configured Slack channel via the Slack API, creating a threaded conversation.
  3. Agent replies in Slack: Your team replies in the Slack thread. Slack sends an event to our webhook endpoint, which is verified using HMAC-SHA256 signature validation.
  4. Visitor receives the reply: The reply is stored and pushed to the visitor's widget in real-time via a reactive query system.

Data stores and subprocessors

Service Role Data stored
Convex Backend database & serverless functions Chat transcripts, visitor info, project config, Slack tokens
Slack Message delivery to your team Message content in your Slack workspace (controlled by your Slack retention policies)
Cloudflare CDN for widget script hosting No customer data, static JS only
AutoSend Transactional and marketing emails Email address, name
Dodo Payments Billing and subscriptions Payment info (handled entirely by Dodo, not stored by Foxchat)

Data retention

  • Default retention: Chat transcripts and visitor data are retained for the lifetime of your project.
  • Deletion: You can delete individual conversations from the dashboard. Deleting your project removes all associated data (conversations, visitors, widget config, Slack mappings). Account deletion permanently removes all data tied to your account.
  • Slack-side retention: Messages posted to your Slack workspace follow your own Slack retention policies. Foxchat does not control Slack-side retention.

Slack Integration Security

OAuth-based integration

Foxchat uses a dedicated Slack app with OAuth 2.0 (not incoming webhooks). When you connect Slack from the dashboard, you are taken through Slack's official OAuth consent flow where you explicitly grant permissions.

Minimum scopes requested

The Foxchat Slack app requests only the scopes necessary for operation:

Scope Purpose
channels:read List available channels for routing
channels:history Read thread replies to detect agent responses
channels:join Join the selected channel to post messages
chat:write Post visitor messages and status updates to Slack
files:read Download files shared by agents in threads
files:write Upload visitor file attachments to Slack
users:read Sync workspace members for agent mapping
reactions:read Detect reactions (e.g. checkmark to resolve)
reactions:write Sync reaction state
emoji:read Fetch custom emoji for rendering in the widget

No admin scopes, no access to DMs, no access to channels outside the ones you configure.

Token storage and revocation

  • Slack access tokens are stored encrypted in our database as part of the workspace record.
  • All data at rest is encrypted using AES-256.
  • Revocation: You can disconnect Slack from the Foxchat dashboard at any time, which deletes the stored token. You can also revoke access from your Slack workspace admin settings (Manage Apps) for immediate effect.

Webhook verification

All incoming Slack events are verified using HMAC-SHA256 signature validation with the Slack signing secret. Requests with invalid or expired signatures (>5 minute window) are rejected. This prevents spoofed webhook calls.

Data Protection & Privacy

Encryption

  • In transit: All connections use TLS/HTTPS. The widget connects over WSS (WebSocket Secure). All Slack API calls use HTTPS.
  • At rest: All stored data is encrypted at rest using AES-256 encryption.

Data residency

  • Our backend infrastructure runs on AWS in the US.
  • Slack data residency depends on your Slack workspace plan and configuration.

Privacy

  • Foxchat collects only the data necessary for chat functionality: visitor name/email (if provided via the Identity API), message content, and project configuration.
  • No tracking pixels, no analytics cookies, no third-party ad integrations.
  • See our Privacy Policy for full details.
  • For DPA requests, contact us directly.

Web & Widget Security

Shadow DOM isolation

The Foxchat widget renders inside a Shadow DOM, which provides CSS and DOM isolation from the host page. This prevents style conflicts and limits the widget's access to the host page's DOM.

XSS and injection mitigation

  • All user-submitted message content is rendered through React's built-in JSX escaping, which prevents script injection.
  • The widget does not use dangerouslySetInnerHTML or innerHTML for user content.
  • Server-side: All backend functions use typed schemas with strict validation, preventing injection at the data layer.

Domain allowlisting

You can configure allowed domains in the widget settings. When configured, the widget will only function on approved domains. Requests from unauthorized domains are rejected server-side.

Content Security Policy (CSP)

To run the Foxchat widget with a strict CSP, add the following directives:

script-src https://cdn.foxchat.dev;
connect-src https://*.convex.cloud wss://*.convex.cloud;
style-src 'unsafe-inline';
img-src https://*.convex.cloud https://*.slack-edge.com;

Version pinning

The widget script is served from Cloudflare CDN. You can pin to a specific version by referencing a versioned URL rather than the latest endpoint. Contact us for versioned URLs.

Assurance & Vulnerability Management

Current status

Foxchat is an early-stage product. We do not currently hold SOC 2 or ISO 27001 certifications, and we have not completed a formal third-party penetration test.

Our backend infrastructure provider maintains SOC 2 Type II compliance.

Security practices

  • All webhook endpoints (Slack, payment provider) verify request signatures using HMAC-SHA256 before processing.
  • OAuth flows use CSRF state parameters to prevent cross-site request forgery.
  • Dashboard endpoints require authentication and verify project ownership before returning data.
  • Replay attack prevention on all webhook endpoints (5-minute timestamp window).

Vulnerability disclosure

If you discover a security vulnerability, please report it to us by email. We aim to acknowledge reports within 48 hours and provide a fix timeline within 5 business days for critical issues.

Incident Response & Reliability

Incident response

  • We monitor service health and investigate issues as they arise.
  • For incidents affecting customer data or service availability, we will notify affected customers via email as soon as practical.

Reliability

  • Backend uptime: Foxchat runs on managed infrastructure that provides high availability.
  • Widget CDN: The widget script is served via Cloudflare's global CDN with edge caching for fast, reliable delivery.
  • Backups: Automated backups are handled by our infrastructure provider.

What we don't yet offer

As an early-stage product, we do not currently publish formal SLAs, RTO/RPO targets, or guaranteed uptime percentages. We are working toward formalizing these as the product matures.

Questions?

If you have additional security questions or need information not covered here, reach out to us and we'll be happy to help.