Where does the data of customers chatting with chatbots go, how is it stored, who accesses it - is the most important security question when making a chatbot. Chatbots handle names, phone numbers, purchase information - need to be encrypted, access controlled, stored according to regulations and minimize data. Zenify records 99.99% uptime (approved) — but security needs to be more proactive than that.
TL;DR
- Chatbot data: name, phone number, application information — needs to be protected.
- Encryption of transmission and storage.
- Control who accesses data.
- Comply with personal data protection regulations.
- Ask the provider: where to save, who can see it, when to delete it.
Dữ liệu chatbot xử lý những gì?
Data type | Example
Personal information | Name, phone number, email
Order information | Products, delivery address
Conversation history | Questions, requests
Behavioral Data | Message time, channel
This is personal data — subject to regulatory protection.
Security risks when using chatbots
Conversation leak: Unauthorized people can read the chat content.
Loose storage: data stored in unsecured places.
Non-essential staff access: many viewers with wide permissions.
AI misremembering: the model "learns" from general input data (needs proper design).
Guest impersonation: trick chatbot into revealing information.
Security standards need to be checked
1. Encryption
Encryption of transmission (between customer ↔ chatbot).
Encrypted storage (data at rest).
2. Access control
Decentralization: who sees what — agents only see what is necessary.
Record access log: who opened which conversation, when.
3. Tối thiểu hóa dữ liệu
Only collect necessary data.
Do not ask for credit cards/CCCD via chat when not needed (see Chatbot for purchases).
4. Archive and delete
Clear retention policy, deletion upon expiration.
Customers can request to delete data.
5. Compliance
Vietnam's personal data protection regulations (Decree 13/2023/ND-CP).
Suppliers must commit to compliance.
Questions to ask the supplier
Where is customer data stored (which server, which country)?
Who can access the data? Your employees or the supplier's?
Is data encrypted — in transit and at rest?
Is the data used to train general AI?
How is the customer's request to delete data handled?
Safe deployment process
Clear declaration: let customers know what the chatbot collects and for what purpose.
Collection limits: Do not ask for sensitive information via chat.
Agent authorization: permission to see data according to role.
Monitoring: monitor unusual access.