04 / Enterprise Trust & Security
An exhaustive breakdown of ChatBox AI's defense-in-depth model: contractual zero model training guarantees, in-transit and at-rest cryptographic isolation, hashed developer key management, and sovereign compliance under the Indian DPDP Act.
Your prompts, code snippets, project briefs, and generated websites are never used to train, refine, or fine-tune public foundation models. We enforce strict enterprise zero-retention API contracts with OpenAI, Anthropic, and Google AI.
All communications between your browser and our servers run strictly over TLS 1.3 with modern cipher suites. Database volumes, account identifiers, and conversation histories are encrypted at rest using industry-standard AES-256.
We support email-based One-Time Password (OTP) Multi-Factor Authentication to shield accounts against automated password stuffing and session hijack attempts.
Developer API keys created for our OpenAI-compatible endpoint are stored strictly as salted SHA-256 hashes. Even in the event of an internal database audit, plaintext keys cannot be decrypted or stolen.
ChatBox AI servers never process, collect, or store raw credit card numbers, CVV codes, or net-banking passwords. All payment transactions are securely offloaded to certified payment partners.
In compliance with India’s Digital Personal Data Protection (DPDP) Act, users retain absolute sovereignty over their data. You can delete individual conversation threads or execute a full account purge at any time.
| Protection Feature | Free Plan | Pro Plan (₹499/mo) | Max Plan (₹1,999/mo) |
|---|---|---|---|
| Zero Public Model Training | Included | Included | Included |
| TLS 1.3 & AES-256 Volume Encryption | Included | Included | Included |
| Multi-Factor Authentication (MFA) | Included | Included | Included |
| Developer API Keys (Hashed SHA-256) | No | Included (60 req/min) | Included (120 req/min) |
| Data Deletion & 30-Day Purge SLA | Included | Included | Included |
| Support Response Priority | Standard (48–72h) | Priority SLA (< 24h) | Dedicated Engineering SLA |
ChatBox AI strictly limits data transmission to vetted enterprise cloud providers. We never share, sell, or syndicate user data with data brokers, ad networks, or telemetry trackers.
| Provider Entity | Role & Data Processed | Datacenter Location | Cryptographic Standard |
|---|---|---|---|
| Firebase (Google) | Authentication & Session Token Verification | India / Global | Encrypted JWTs, OAuth 2.0 |
| Supabase & Appwrite | Database & Private File Storage | India / Frankfurt | AES-256 Volume Encryption, Row Level Security |
| Razorpay & Paddle | Payment Processing & Subscription Management | India / UK | PCI-DSS Level 1 Certified, Tokenized Vaults |
| OpenAI, Anthropic, Google AI | Foundation Model Inference Providers | US / EU / Global | Commercial Zero-Training Enterprise APIs |
Turn on email OTP verification in Settings to prevent credential-stuffing attacks.
Never commit developer API keys into public Git repositories or client-side web bundles.
Avoid pasting production passwords, live tokens, or confidential PII into prompt text.
Regularly delete completed project conversations and website drafts from your dashboard.
We welcome reports from independent security researchers. If you identify a potential security vulnerability, report it to our Data Protection Officer and security engineering team for prompt investigation and triage.