Security & data
Last updated October 2026
This page explains, in plain language, what PageMind stores, where it goes, and the controls you have. We only describe measures that are actually in place today.
What we store
- Your content — pages we crawl, files you upload and answers you write, split into passages and indexed for search.
- Conversations — messages between visitors and your assistant, the sources used, and feedback ratings.
- Leads — contact details visitors choose to share in the chat.
- Account & billing — your login (via Clerk) and subscription status (via Stripe). We never see or store full card numbers.
How your content is used
Your content is used only to answer questions asked to your own assistants. We do not use it to train AI models. Replies are generated through the Google Gemini API and search uses OpenAI embeddings, both under their paid API terms, which do not allow them to use API data to train their models.
Safeguards in the product
- All traffic is encrypted in transit with HTTPS.
- Each customer’s content lives in an isolated search namespace; every dashboard request checks that you own the resource.
- Assistants are instructed to answer only from your content and to treat text in your documents as data, never as instructions.
- Answers can’t load remote images or run HTML, which blocks a common way of leaking chat data.
- Website crawling refuses private and internal network addresses.
- An optional domain allowlist limits which websites can use your assistant.
- Rate limits and hard monthly usage caps protect you from abuse and surprise costs.
- Webhooks are signed with HMAC-SHA256 so your systems can verify they came from PageMind.
Subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Google (Gemini API) | Generates assistant replies, training summaries and OCR for scanned PDFs | United States |
| OpenAI (API) | Creates text embeddings used to search your content | United States |
| Pinecone | Stores embeddings (vector search index) of your content | United States |
| Vercel | Application hosting, uploaded file storage (Vercel Blob) | United States |
| Database provider (PostgreSQL) | Stores accounts, chatbot settings, conversations and leads | United States |
| Clerk | Account sign-up and authentication | United States |
| Stripe | Payments and billing | United States |
| Resend | Transactional email (lead alerts, hand-off requests, usage alerts) | United States |
| Firecrawl (if enabled) | Fetches website pages you ask us to crawl | United States |
Deleting data
Deleting a data source removes its indexed content from your assistant. Deleting an assistant removes its content index, conversations and leads. To delete your whole account, email support@sabrsoftware.com.
Reporting a vulnerability
If you believe you’ve found a security issue, please email support@sabrsoftware.com with details. We’ll acknowledge your report and keep you updated.