Chatbot security checklist: what to verify before you trust a platform

Updated 2026-09-19 · 5 min read · By the Convo360 team

Why this matters even for a 'simple' chatbot

A WhatsApp or website chatbot handles customer phone numbers, names, order details and sometimes payment links — real personal and business data flowing through a system connected to the outside world via webhooks, APIs and login sessions. Treat it with the same seriousness you would any other system holding customer data, not as a lightweight add-on tool bought once and forgotten.

Most buyers evaluate a chatbot platform on flows, templates and pricing, and only think about security after something goes wrong — often after a departing employee still had access, or a webhook was abused by someone outside the business. The checklist below is meant to be run before you commit, using direct questions a vendor should be able to answer immediately rather than a general reassurance that 'security is a priority.'

1. Are API keys and credentials encrypted at rest?

Your AI provider key, WhatsApp access token, and any payment or integration credentials should never be stored as plain, readable text in a database. Ask directly: 'Are our stored keys encrypted at rest?' A vendor should be able to answer this plainly and immediately — hesitation is itself a signal, and so is an answer that changes the subject to 'we use a secure cloud provider' without addressing encryption specifically.

2. A device cap per login and login protection

If a password leaks, the damage is far worse if the attacker can log in alongside the legitimate user without either noticing. A platform that caps how many devices can be signed in to one login, for example up to 3 devices, signing out the oldest automatically the moment a 4th device signs in, keeps stray sessions from piling up and surfaces suspicious access quickly rather than letting an old, forgotten login sit active indefinitely. Pair this with a login captcha to slow down automated password-guessing attempts, and a proper forgot/reset password flow that does not leak whether an email exists in the system. A sensible default like 'keep me signed in for 30 days' is convenient, but it should still sign an idle session out after a short window, around 30 minutes, when that option is switched off.

3. Signed webhooks

Webhooks let external systems trigger your flows (inbound webhooks) or let your flows notify external systems (outbound webhooks). Without verification, anyone who guesses or discovers a webhook URL could send fake requests and trigger actions in your flows. HMAC-signed webhooks let the receiving side verify that a request genuinely came from the expected sender using a shared secret, rejecting anything that does not match. Ask whether both inbound and outbound webhooks are signed, not just one direction.

4. Staff roles, not one shared login

If every team member shares one owner login, you lose the ability to know who changed what, and a departing employee's access cannot be revoked individually without changing a password everyone else also uses.

5. Backups and provider-side errors

Ask two specific backup questions: how often is the database backed up, and are media/file uploads (images, documents customers send, knowledge base files) backed up too, or only structured data? A vendor with a clear, specific answer ('nightly database backup, media backed up separately') is more trustworthy than a vague 'yes, we back up regularly.'

Separately, even a secure platform can quietly stop working correctly if a connected provider has a problem, an expired AI key, an exhausted WhatsApp quota, a telephony account running low on balance. Ask whether the platform actively detects these provider-side errors and alerts you, rather than leaving you to discover a broken bot from a frustrated customer. A vendor that can show you a real alert screen, rather than describe the feature in the abstract, is a good sign. Ask to see it during a demo rather than taking the description at face value.

How Convo360 answers this checklist

Convo360 stores API keys and credentials encrypted at rest, limits each login to 3 signed-in devices with 'keep me signed in for 30 days' available and a 30-minute idle sign-out otherwise, uses a login captcha, and provides a proper forgot/reset password flow. Webhooks, both inbound triggers and outbound notifications, are HMAC-signed. Staff access follows defined roles (owner, admin, support, finance, analyst), each scoped to what that role actually needs, and the platform runs nightly database backups plus separate media/uploads backups, with provider health monitoring flagging issues like an expired AI key with a clear alert. Take this same table, with the Convo360 column blanked out, to any other vendor you are evaluating: it is the same set of questions regardless of which platform you eventually choose.

Step by step

1. Ask about key encryption directlyAsk the vendor in writing whether stored API keys and credentials are encrypted at rest.
2. Confirm session and login protectionsCheck for a per-login device cap, a login captcha, and a proper password reset flow.
3. Ask which webhooks are signedConfirm both inbound and outbound webhooks use HMAC signing, not just one direction.
4. Review the staff role optionsCheck whether roles like owner, admin, support, finance and analyst exist, or if everyone shares one login.
5. Get specifics on backup frequency and scopeAsk exactly how often the database is backed up and whether media/uploads are backed up separately.
6. Ask about provider-error alertingConfirm the platform tells you when a connected AI or telephony provider is erroring, rather than failing silently.

Example conversation

Frequently asked questions

Related reading

Available across India — see WhatsApp & AI calling automation by state and city.