# Security and privacy

## What visitors can reach

The widget runs in a sandboxed iframe on a separate origin. It has no access to your page, cookies, local storage or credentials. Your site and the widget talk through a small message channel, and both sides check the sender and the shape of every message.

## Your project id

The public project id (`pk_…`) is meant to be in your page. It cannot read or change your account. Your account is protected by sign-in, and every call that manages projects needs an [access token](/api/authentication).

## Allowed origins

Public endpoints answer only for origins you list. Browsers also block other sites from calling the chat endpoint directly. See [install the widget](/guides/install-widget#allowed-origins).

## Your documentation

* Only public pages are crawled. Login-protected documentation is not supported.
* Fetching is restricted to the site you add. Loopback, private, link-local and reserved addresses are blocked, including after redirects.
* Pages are treated as untrusted text, never as instructions.

## What is stored

Docora stores your indexed page text, your project settings, and visitors' conversations (questions, answers and the pages cited) so you can review them. Conversations are tied to a random conversation id, not to a person; the widget does not read your visitors' identity or your page content.

## Reporting a problem

If you find a security issue, report it privately to the Docora team instead of opening a public issue.