_Last updated: September 27, 2026_
BotConnector uses layered controls to protect accounts, application data, service credentials, and billing integrity. This page describes the security posture of BotConnector AI on botconnector.id.
1. Transport security
Public BotConnector web services use HTTPS. Sensitive application traffic is intended to travel over encrypted transport between the client and BotConnector endpoints.
2. Authentication and account isolation
Authenticated features require account or API authentication appropriate to the interface.
Application data and requests are scoped to the authenticated user or account context. Server-side authorization checks are used to prevent one account from intentionally retrieving another account's protected resources.
3. API keys and service secrets
BotConnector service credentials and upstream provider credentials are kept on the server side and are not intended to be exposed to browser clients.
User API keys should be treated as secrets. Users are responsible for storing them securely and rotating or revoking them if compromise is suspected.
4. Local AI boundary
Supported Local AI execution is designed to send inference to a local runtime on the user's device, typically through local-only networking.
Account authentication, model discovery/download, software updates, and other cloud features may still require internet access. Users should verify the selected execution target before submitting sensitive data.
5. Cloud AI routing
Cloud inference is routed through supported provider integrations. BotConnector validates internal routing and billing context before eligible paid requests are sent to a provider.
Provider availability and security are also subject to the controls and infrastructure of the relevant third-party provider.
6. PAYG billing integrity
PAYG usage is tracked through server-side billing records. Eligible paid requests use reservation and settlement controls so that service usage and account balances can be reconciled.
Client-supplied headers or browser input are not treated as trusted proof of paid entitlement.
7. Files and uploads
File-processing endpoints apply server-side validation and product limits. Users should avoid uploading secrets or highly sensitive material unless the selected feature and execution mode are appropriate for that data.
Temporary and saved file behavior is described in the relevant product documentation and Privacy Policy.
8. Abuse and application security
BotConnector uses controls such as request validation, rate or concurrency limits where appropriate, security logging, provider boundary checks, and abuse protections.
No security system is perfect. We continuously treat security findings and production regressions as issues to investigate and remediate.
9. Payment security
Where checkout is provided by Paddle or another approved payment provider, payment-card handling occurs on the payment provider's systems. BotConnector does not need to store full card numbers to activate service usage after verified payment.
10. Responsible disclosure
If you believe you found a security vulnerability, do not exploit it beyond what is necessary to demonstrate the issue and do not access other users' data.
Report the issue through BotConnector Support with:
- the affected URL or component;
- clear reproduction steps;
- expected and observed behavior;
- any non-sensitive evidence that helps us reproduce the issue.
Please avoid publicly disclosing an unresolved issue before we have had a reasonable opportunity to investigate it.
11. Scope and changes
Security controls may evolve as BotConnector changes infrastructure, models, providers, or product capabilities. We do not claim a certification unless it is explicitly listed as current and verified on the site.