Team and access

Invite from Workspace → Members. The invitee gets an email, accepts, and sets a password. Pending invites can be resent or revoked, and one login can belong to several workspaces, which is useful for agencies and contractors.

Roles are described in Operators and seats. In short: owner can do everything including billing, admin can configure but not bill, operator can only handle conversations and view leads.

• Email and password, or Continue with Google.
• Email verification is required before you can train or publish a chatbot.
• Password reset by email; repeated failed sign-in attempts are throttled.
• Changing your account email requires confirming the new address before the change applies.
• Operators sign in with their own credentials, separate from the workspace owner's.

• Treat your API key as a full-access credential. Rotate it if it has ever been pasted anywhere you would not paste a password.
• Remove operators who leave. Deactivating them ends their access and frees their seat.
• Set the domain allowlist on every chatbot so your bot key cannot be used on someone else's site.
• Administrative actions in the workspace are recorded in an audit log.

To report a security issue, follow the responsible disclosure policy. Please do not report vulnerabilities through the public support inbox.