Security

Live chat security, in specifics

Most vendor security pages are adjectives - "enterprise-grade", "bank-level", "military-grade". None of those are checkable. This page lists what ZChat actually does, in enough detail that you can go and verify it on your own server, because that's the whole point of self-hosting.

Download Free Evaluation Where Your Data Lives

Getting in

The agent console is the valuable target - it can read every conversation you've ever had. So that's where the effort goes.

Password storage

PBKDF2 with HMAC-SHA256, 100,000 iterations, 16 random bytes of salt per password. Every stored hash carries its own salt and iteration count, so you can raise the work factor later without forcing a reset. If you're upgrading from an older install, legacy SHA-256 rows are quietly rewritten to PBKDF2 the next time that agent logs in successfully.

Login throttling

Five failures, then a 15-minute lockout. The detail that matters: the counter is keyed on IP and username together. Lock on IP alone and one attacker can lock out an entire office behind a single NAT address - the defence becomes the outage.

Two-factor authentication

Standard TOTP - the same six-digit codes your authenticator app already generates. Turning it on requires proving a working code first, so nobody locks themselves out of their own account by enabling it with a mistyped secret.

IP blocking

Block a single IPv4 address or a whole CIDR range like 203.0.113.0/24, applied before a blocked visitor reaches the chat queue. You can also block an address straight from a session transcript, which is when you usually want to.

Hostile input

A live chat widget is an open text box on the public internet, wired to a window where your staff work all day. Treat everything arriving through it as hostile.

The attack	What ZChat does
Script in a chat message	Messages go through an HTML sanitiser before anyone sees them, so typed markup is neutralised rather than rendered in the agent console.
Executable disguised as an image	Uploads are matched against the magic bytes for their declared type. An unknown type is rejected, not assumed safe.
Right-to-left filename trick	Invisible Unicode direction-control characters are stripped from filenames, so an attachment can't display a fake extension. Non-Latin scripts still work - the strip targets formatting characters, not letters.
Scripted abuse of public endpoints	The anonymous widget endpoints are rate limited per IP in a sliding window, returning 429 with `Retry-After`.
Clickjacking and MIME sniffing	The dashboard sends Content-Security-Policy, `X-Frame-Options: SAMEORIGIN`, `X-Content-Type-Options: nosniff` and a Referrer-Policy.

One deliberate exception worth knowing about: the strict Content-Security-Policy is not applied to the embeddable widget. The widget's job is to run inside pages ZChat doesn't control, and a policy written for our dashboard would break on yours. The widget is isolated with Shadow DOM instead.

After the fact

Who did what, and when

Prevention isn't the whole job. ZChat writes an audit log covering agent and department changes, IP blocks, settings and privacy actions, authentication events and webhook changes - filterable by date, paginated, exportable to CSV when someone needs evidence rather than a screenshot.

Useful reading alongside this: GDPR and HIPAA considerations for self-hosted chat.

Signed webhooks

Outgoing webhooks are signed with HMAC-SHA256 over a timestamp and the body, so your receiving endpoint can reject anything that didn't come from your server. More on the integration surface.

Your network, your rules

The biggest security property isn't in this list: there's no vendor tenant to be breached alongside. If you want it truly sealed off, ZChat runs air-gapped.

What this page doesn't claim

Self-hosting moves responsibility as well as control. ZChat can't patch your operating system, configure your TLS, manage your database backups, or stop an agent reusing their password somewhere else. Software that claimed otherwise would be lying to you.

There's also no third-party penetration test or SOC 2 report to point at. If your procurement process requires one, that's a genuine reason to weigh ZChat carefully rather than a box we can tick for you. What we offer instead is inspectability: it runs on your hardware, the traffic is yours to watch, the database is yours to query, and the source licence is available if you want to read the implementation rather than trust a summary of it.

How are agent passwords stored?

PBKDF2 with HMAC-SHA256, 100,000 iterations, and a 16-byte random salt per password. Each stored value carries its own salt and iteration count, so the cost can be raised later without invalidating existing logins. Older SHA-256 rows from a legacy install are rewritten to PBKDF2 on the account's next successful login.

What stops someone brute-forcing an agent login?

Five failed attempts triggers a 15-minute lockout. The counter is keyed on IP address and username together rather than IP alone, because an IP-only lockout lets one attacker lock out every agent sitting behind the same office NAT. Agents can also enable TOTP two-factor authentication, which works with any standard authenticator app.

Can a visitor inject scripts into an agent's screen?

Chat messages pass through an HTML sanitiser before they reach anyone, so markup a visitor types is neutralised rather than rendered. The dashboard also ships Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy headers. The policy is deliberately not applied to the embeddable widget, which has to run inside pages ZChat does not control.

How are file uploads handled?

Uploads are checked against the magic bytes for their declared content type, so renaming an executable to .png does not get it through, and an unrecognised type is rejected rather than assumed safe. Filenames are also stripped of invisible Unicode direction-control characters, which are the trick behind attachments that appear to have a harmless extension.

Do I have to take your word for any of this?

No, and you should not. ZChat is self-hosted software you download and run, so every claim on this page is inspectable on your own server: read the configuration, watch the traffic, query the database directly. The source licence is available if you want to read the implementation itself.

Owned customer support software

Deploy live chat on your own terms, not on someone else's pricing model.

ZChat gives you the installable server, web dashboard, website widget, and desktop agent tools in one self-hosted product you buy once and keep. Run it on infrastructure you trust and connect AI only if and how you want it.

Download ZChat See Product Demo

Deployment

Install on Windows or Linux, behind IIS or Nginx, in a VM, or in Docker if that fits your stack.

Commercial model

One-time purchase, perpetual license, and no monthly per-agent bill attached to growth.

AI Flexibility

Use Ollama locally or connect OpenAI and Anthropic with your own provider accounts.