Live chat security: how we protect your website
The chat runs on your website and anyone can type into it, so Parlar checks what comes in at four points, from the visitor’s browser to your panel.
-
- Messages shown as text
- Its own Shadow DOM
- Nothing from other companies
-
- HTTPS, TLS 1.2 or later
- Protection against DDoS attacks
-
- Your allowed websites
- Signed identity
- Limits on size and speed
- Separate accounts
-
- Passwords hashed with scrypt
- Secure session cookies
- Limits on sign-in attempts
In the chat on your website
<script>alert('hi')</script>
-
Messages stay text
Messages, names and texts from settings are shown as text, so code typed into the chat never runs on your page.
-
Its own Shadow DOM
The chat’s styles and yours stay apart, so neither can break the other.
-
Nothing from other companies
The widget loads no fonts, trackers or code from anyone else.
-
Limits for visitors
Messages can be up to 2,000 characters, and visitors who send them too fast are asked to wait.
On the Parlar server
The server applies your site’s settings and its own limits to every connection.
-
Your allowed websites
When you list your websites in Settings, the chat only connects from those addresses. You can list up to 20 per site.
-
Signed identity
A customer’s name counts only when your store signs it with your site secret (HMAC-SHA256). A signature is valid for 48 hours.
-
Limits against floods
Connections, messages, forms and notifications all have limits on size and frequency.
-
Separate accounts
Every request for data is filtered by account, and our tests check that one account can’t read another’s conversations.
-
A closed API
The panel’s API only answers Parlar’s own app. Other websites can’t call it.
In your panel
Your team signs in to app.parlar.chat to read and answer conversations.
-
Passwords hashed with scrypt
Parlar stores a hash of each password, never the password itself.
-
Secure sessions
The session lives in a cookie that pages can’t read with JavaScript and that only travels over HTTPS.
-
Limits on sign-in attempts
After too many failed attempts, signing in pauses for a few minutes.
Where your data lives
-
A server in New York
Conversations are stored on a DigitalOcean server in New York, behind Cloudflare.
-
HTTPS everywhere
Connections use HTTPS with TLS 1.2 or later, from the browser to Cloudflare and from Cloudflare to our server. Browsers are told to use HTTPS only.
-
A closed server
The server only accepts web traffic that comes through Cloudflare, and its keys are kept outside the code.
-
Daily backups
The database is backed up every day.