How your data stays separated from everyone else's, who inside your workspace can do what, and how the two secrets in play — your widget's API key and the credentials Promptly holds for you — are protected.
Most of this is automatic. Exactly one thing needs a decision from you: the list of domains allowed to use your widget.
- Data isolation & storage modes — how tenant data is separated, and the three storage modes.
- Roles & permissions (RBAC) — the permission each role holds, enforced on the server rather than in the UI.
- Origin guard & rate limiting — restricting which websites may load your widget, and the limits that absorb abuse.
- API keys & encryption — what your API key is, when to regenerate it, and what Promptly encrypts at rest.
If you only do one thing on this page: add your domains to the allow-list and turn on strict origin. See Origin guard & rate limiting.