Security at a glance
- The project key is public by design, so it can’t prove who a user is.
- The signing secret lives on your server only, and signs a token that proves who a user is.
- With Only allow verified users on, HelpAlive refuses chat, assist and usage requests without a valid token.
- By default, your team is signed out of the dashboard after 7 days without activity, and after 30 days at most.
- The script, the usage and chat endpoints and the dashboard are all served over HTTPS.
Two keys: one public, one secret
The project key is public by design. Anyone can read it from your page, so it can’t prove who a user is.
- Regenerate the project key at most once an hour. The old key may still be accepted for up to 30 seconds, so update your script straight away.
- Rotate the signing secret at any time. The previous secret keeps working until you rotate again, so nobody is refused while your servers update. If a secret leaked, rotate twice: once to issue a new one, and again after your server uses it, so the leaked one stops working.
Verified users
Without verified users, HelpAlive trusts the user id your page sends inidentify(). Someone who knows your public project key and another user’s id could then read that user’s chat history.
Verified users close that gap. Your server signs each user id with your signing secret, and your page passes the signed token to identify(). Then turn on Only allow verified users on Settings → Setup & API Key. From then on, HelpAlive refuses chat, assist and usage requests without a valid token.
The switch turns on only after a verified sign-in in the last 30 minutes. That stops you locking out your own users by mistake. You can turn it off at any time.
Dashboard sign-in
Your team signs in to the dashboard with an email address and password. New accounts confirm their email with a 6-digit code. How long a sign-in lasts is set on Settings → Team & access. By default, your team is signed out after 7 days without activity, and after 30 days at most. You can change both. Saving a shorter setting signs out anyone already past it. On Account, each person sees the devices signed in as them, and can sign out one device or press Sign out other devices. Passwords are changed with a code sent by email. Everyone on your team is an admin and can change every setting. Use Who can join on Settings → Team & access to allow invites only to your company’s email domain.Confirm your password on sensitive actions
Some actions ask you to confirm your password first, in a Confirm your password box. You won’t be asked again for a few minutes. These actions include:- regenerating your project key on Settings → Setup & API Key;
- changing how long a sign-in lasts on Settings → Team & access;
- inviting teammates, resending an invite, and reactivating someone on your team;
- changing Your allowed domains;
- deactivating someone on your team;
- changing how long chat and assist text is kept on Settings → Privacy Management;
- signing out a device, or your other devices.
HTTPS
The script, the usage and chat endpoints and the dashboard are all served over HTTPS. Data between your users’ browsers and HelpAlive is encrypted in transit.Where data is hosted
HelpAlive’s servers and databases run in the United States, in US East (Virginia). Each customer’s data is kept logically separate, and every request is limited to that customer’s own data. See Subprocessors for the companies involved.Check it works
- On Settings → Setup & API Key, check that Your project key is the one in your script tag.
- Check that your signing secret appears nowhere in your pages or front-end code.
- Sign in to your app, open the agent, and check that Check your setup finds a verified sign-in. Then turn on Only allow verified users.
Troubleshooting
- Users are refused after you rotated the secret twice. Your server still uses a secret older than the previous one. Put the newest secret on your server.
- “Too soon to regenerate”. The project key can be regenerated once an hour. Keep using the current one until then.
Privacy policy and terms
These pages explain how HelpAlive handles data in practice. The legal terms are in our Privacy policy and Terms of use.Next
Verify users
Sign user ids on your server.
Data we collect
What’s collected, kept and deleted.
Team & access
Invites, allowed domains and sign-in length.