Security & Privacy

The chat endpoint is public by necessity, since visitors have to be able to reach it without logging in, and it spends your Cloudflare allocation. This page covers where data goes and what stops the endpoint being abused.

Where data goes

A visitor's message travels from their browser to your Cloudflare Worker. There it is embedded, matched against your Vectorize index, and answered by a model running on your Cloudflare account. The reply streams back to the browser.

Flarepipe and Six Foot 3 are not in that path at any point. We do not receive visitor messages, we do not receive your content, and we have no access to your Cloudflare account. There is no telemetry endpoint in the plugin.

Your data processor for this feature is Cloudflare, under your own account and your own agreement with them. If you maintain a privacy policy that lists processors, that is what to record.

What is stored

• In your Vectorize index: chunks of the content you chose to index, with their source URLs.
• In your WordPress database: the plugin's settings, your knowledge entries, and the encrypted operational token.
• Conversations: not stored anywhere. History exists only in the visitor's browser for the life of the page; closing the tab discards it. Transcript logging is on the roadmap and is not built.

Credential handling

The setup token is never written to the database. The narrow operational token that replaces it is encrypted with AES-256-GCM, keyed from your WordPress salts. The ingestion secret that protects writes to your index is generated as 64 random hex characters and stored the same way. The full token lifecycle is described in Cloudflare setup.

Protecting the endpoint

Origin allowlist

Browser requests are only accepted when they come from your own domain. Someone who finds your Worker URL cannot embed your chatbot on their site and spend your allocation.

Rate limiting

Each IP address is limited to 20 messages per minute, enforced by a Durable Object counter. If you attached a custom domain, a zone-level rate limiting rule is added as a second layer. The limit is fixed in this release; making it configurable is on the roadmap.

Input caps

Conversation history is capped at 20 messages, each at 4,000 characters. Anything the client sends claiming to be a system instruction is discarded before the model sees it, so a visitor cannot inject their own instructions by manipulating the request body.

Prompt injection

Visitors will try to talk the bot out of its instructions, and any content you index could in principle contain text aimed at doing the same. The system prompt is written to resist the common attempts: it refuses to disclose its own instructions, ignores requests to abandon them, will not adopt a role a visitor assigns it, and treats retrieved content as untrusted data to answer from rather than instructions to follow.

This is mitigation, not a guarantee. No system prompt is immune, and you should not put anything in the prompt or in your site facts that would cause harm if a visitor extracted it. Site facts are for public information.

What the widget renders

Model output is escaped first and then given back a narrow subset of Markdown, with links restricted to http, https and root-relative URLs. HTML in a model's reply is displayed as text, never executed. Ingestion secrets are compared in constant time.

Things to be aware of

• The plugin needs the openssl PHP extension for its encryption. Without it, setup will not proceed.
• Cloudflare API tokens belong to the user who created them; if that person loses account access, the plugin needs re-onboarding.
• Uninstalling the plugin removes its local data but deliberately leaves your Cloudflare resources in place. Remove those yourself if you want them gone.
• An AI answering questions about your business will sometimes be wrong. Say so in the widget's greeting or nearby, keep your indexed content current, and always give the bot a human to hand off to.