Platform
Privacy and security for web integrations.
Messenger and Feedback run in isolated EveryHello frames, validate the embedding domain, and treat their installation keys as public identifiers rather than secrets.
Public keys and domain allowlists
Keys beginning with wgt_ and fdb_ must appear in browser source so a website can load its widget. Possession of a key alone is not enough to use the integration.
Every widget request is checked against the allowed domains configured for that product. Empty or malformed allowlists fail closed, and subdomains of an allowed host are accepted.
Do not treat public widget keys as server secrets
Keep database credentials, provider tokens, and EveryHello server credentials out of browser code. Widget keys are the only EveryHello identifiers intended for these snippets.
Iframe isolation
The customer-facing UI renders inside an iframe served by EveryHello. The Messenger loader reads its script key and the host origin. The Feedback SDK also reads basic page context and values explicitly provided through its API.
Cross-window messages are checked against the expected EveryHello origin and iframe window before they change widget state. Feedback verifies the embedding page through the browser-stamped message origin.
Data handled by each product
| Product | Typical data |
|---|---|
| Messenger | Visitor identifier, messages, conversation history, channel status, and records created by configured assistant actions or team handoff. |
| Feedback | Feedback kind, message or rating, optional attachment, optional reporter identity, source page context, browser details, and custom application context. |
Data minimization
- Pass only identifiers and context your team will use to resolve the conversation or review the feedback.
- Call
EveryHello.feedback.reset()when a user signs out or changes accounts. - Do not place access tokens, passwords, payment data, protected health information, or private URL query values in custom context.
- Explain your use of support and feedback tools in your own privacy notice and consent flow where applicable.
- Rotate a widget key from the authenticated setup page if you need to invalidate an existing installation.
Service limitation
EveryHello is not offered as a HIPAA-compliant service and does not provide a Business Associate Agreement. Do not use the widgets to process protected health information.
Content Security Policy
A restrictive site must allow the loader script and the customer-facing iframe. Merge the required sources into your current directives.
Content-Security-Policy:
script-src 'self' https://www.geteveryhello.com;
frame-src https://www.geteveryhello.com;More information
Review the public Privacy Policy, Terms of Service, and product-specific setup guidance before deployment. Security or privacy questions can be sent to support@geteveryhello.com.