{"ok":true,"product":"Site Rep","updatedAt":"2026-08-11","status":"beta_with_confirmed_controls","certificationStatus":"not_certified","trustPage":"/trust","privacyPage":"/privacy","termsPage":"/terms","releaseStatus":{"marker":"launch-hygiene-proof-health-2026-08-26","markerUpdatedAt":"2026-08-26","branch":"main","stage":"production_hardening","publicTrustUpdatedAt":"2026-08-11","commit":"278356f7cc099bf280b74f94790a715de947b0e4","deployedAt":"2026-08-31T19:55:35Z","source":"deploy-stamped"},"confirmedControls":[{"area":"Grounded answers","status":"confirmed","evidence":"Public widget answers from approved sources and asks for team follow-up when approved sources do not cover the question."},{"area":"Customer dashboard","status":"confirmed","evidence":"Customer dashboard includes conversations, leads, source gaps, install health, exports, notifications, and deletion-review requests."},{"area":"Visitor data minimization","status":"confirmed","evidence":"Visitor records store only the question and any name/email/need the visitor chooses to submit. Visitor IP addresses are used only transiently in memory for rate limiting and abuse prevention; they are not written to conversations or leads."},{"area":"No tracking cookies","status":"confirmed","evidence":"The chat widget sets no cookies and no persistent local storage. It uses session-only storage (cleared when the browser tab closes) for a random session id."},{"area":"Sub-processors disclosed","status":"confirmed","evidence":"Data is processed by Cloudflare (Workers, Workers AI, D1, R2, KV), Dodo Payments (billing), and the configured email provider. Cloudflare's Workers AI terms say customer content is not made available to other customers and is not used to train or improve services unless explicit consent is given; Site Rep storage services still keep the app data disclosed here."},{"area":"Access control","status":"confirmed","evidence":"Admin, customer, developer API, and public widget surfaces are separated by server-side checks."},{"area":"Paid unlock","status":"confirmed","evidence":"Billing activation paths require server-verified payment records before customer access unlocks."},{"area":"Abuse controls","status":"confirmed","evidence":"Public signup, chat, lead, install, feedback, payment, and developer API routes have rate limits."},{"area":"Storage boundary","status":"confirmed","evidence":"Durable Object primary store, D1 ledgers, private R2 source content, and bounded KV mirror are server-side."},{"area":"Public source imports","status":"confirmed","evidence":"Website crawl, exact URL list, readable public cloud links, RSS/Atom feeds, source files, and FAQ exports import through server routes with source receipts."}],"dataMap":[{"data":"Approved website sources","purpose":"Answer visitors from approved sources and support source-health checks.","customerControl":"Edit, replace, audit, export, and roll back supported snapshots.","ownerControl":"Edit, replace, audit, export, and roll back supported snapshots."},{"data":"Visitor conversations and feedback","purpose":"Show follow-up inbox, source gaps, quality checks, and follow-up needs.","customerControl":"Review and export from the private dashboard.","ownerControl":"Review and export from the private dashboard."},{"data":"Lead details","purpose":"Let the site team follow up with a visitor who asked for help.","customerControl":"Review, status, notes, follow-up dates, and CSV export.","ownerControl":"Review, status, notes, follow-up dates, and CSV export."},{"data":"Payment and billing records","purpose":"Verify checkout, activation, billing portal access, renewals, and plan state.","customerControl":"Billing portal when linked; manual support fallback through hello@siterep.net.","ownerControl":"Billing portal when linked; manual support fallback through hello@siterep.net."},{"data":"Operational events","purpose":"Show install checks, source health, quota warnings, notification receipts, and errors.","customerControl":"Dashboard visibility, follow-up queue, notifications, and exports.","ownerControl":"Dashboard visibility, follow-up queue, notifications, and exports."}],"notClaimed":["SOC 2 Type II","GDPR certification","HIPAA compliance","BAA coverage","DPA availability","zero retention","no-training-on-data status","native OAuth marketplace integrations","private cloud folder sync","full helpdesk replacement","two-way CRM sync","automated external-system execution","guaranteed conversion lift","guaranteed setup time","enterprise omnichannel coverage"],"needsReview":[{"area":"Legal and compliance","status":"needs_review","evidenceNeeded":"Privacy policy, DPA, BAA, subprocessor list, retention windows, deletion fulfillment, and regional data-rights review."},{"area":"Provider retention","status":"needs_review","evidenceNeeded":"Verified model, payment, email, Cloudflare storage, and backup retention settings."},{"area":"Production release","status":"needs_review","evidenceNeeded":"Cloudflare dry run, deploy freshness, live monitor results, real customer install evidence, and real-card paid unlock evidence."},{"area":"Native integrations","status":"needs_review","evidenceNeeded":"OAuth scopes, consent screens, marketplace approval, audit logs, and rollback-safe ticket or CRM writes."}],"support":{"email":"hello@siterep.net","deletionReview":"Customers can open a deletion-review request in the dashboard; it is tracked for review and is not instant erasure."},"configuredSignals":{"dodoProductsConfigured":true,"notificationsConfigured":true,"publicBaseUrl":"https://siterep.net"}}