Security improvements across chat, Studio and your team

Shipped

October 29, 2026

Area

Security

Available on

Every plan

Most security work is invisible when it's done well, which also makes it easy to wonder about. Over the past few months we've reviewed how Hyperleap handles your chatbot, the links and keys you give it, and the people on your team, and tightened each of them. Here's what changed, in plain terms. None of it needs any action from you.

What's new

What visitors can see

• Visitors aren't told how your chatbot is built. The chat no longer sends visitors any detail about which AI model or provider your chatbot runs on.
• Your Actions stay private. When your chatbot calls one of your Actions, what it sends to your API and what comes back stay on our servers. The visitor's chat only shows the reply.
• Visitor sign-in codes are harder to misuse. Verification codes expire after a few minutes, work only for the chatbot that sent them, and repeated wrong guesses are limited.

Links and keys you give us

• Website addresses you enter are checked. When Studio fetches a page you give it, such as your website for brand import or an image, it only reaches public internet addresses, and it checks every redirect along the way. The same protection covers your Actions.
• Keys stay out of logs. Request and run logs your team can read no longer store API keys, cookies or sign-in headers, and API keys are masked in our own logs.
• Safer links in chat. Links, images and videos in Studio's chat views are checked before they're shown, and Studio runs with a strict content security policy in your browser.

Your team

• Removed members stay removed. Someone you take off your team can only come back if you invite them again.
• The Owner is protected. The account Owner can't be removed or demoted by another teammate. Ownership only moves by a transfer.
• Billing needs an Owner or Admin. Starting a subscription, buying credits, redeeming a promo code and opening the billing portal now take an Owner or Admin. Members see who to ask instead.
• Invites work for people who already have an account. Someone who signs in from an invite link now joins your team, instead of being sent elsewhere.
• Locked accounts are signed out. A locked account can't keep a session going in the background.

Limits on traffic

• Fairer rate limits. Requests that don't come from a signed-in user are limited per connection, so one source can't sidestep the limit.

Good to know

• There's nothing to set up. Every change is already live for every chatbot and every account.
• Your chatbot works the same. Visitors get the same answers. They just see less of what happens behind them.
• The basics haven't changed. Hyperleap runs on Microsoft Azure, with encryption in transit and at rest, daily backups and role-based permissions. We follow established security best practices and keep improving them. More on our security page.