Chat Privacy

VeriPrompt's chat terminal shows a persistent privacy badge that tells you, truthfully, whether your organization's administrators can read a given conversation — and gives you a one-time notice whenever your company's chat storage posture changes.

Administrators control the posture itself: how chat history is stored at rest, how long it is kept, and whether Shield-masked text is stored instead of restored text.

Storage Modes

A company's chat history is stored in one of three modes. The mode determines what exists on disk — and, with the other factors described below, what the privacy badge tells your users.

Mode	What is stored	Who can read it
Plaintext (default)	Chat history is stored as-is.	The server, a DBA, and company administrators.
Company key	New conversations are encrypted at rest with AES-256-GCM under a key your company holds.	Company administrators can still decrypt and read every conversation.
User key	Each conversation is encrypted with a key generated and held only on the user's own device, never sent to or derivable by the server.	Only the user. Not administrators, not support, not someone holding a stolen database backup.

Company key is not privacy from your employer

Company key defends a stolen database backup. It does not make chats private from your organization. Administrators hold the key and can decrypt every conversation. Only user key makes a conversation unreadable by your employer — which is why it is the only mode that can produce a Private to you badge.

User key history cannot be recovered

Under user key, the decryption key exists only on the user's device. If a user clears their browser data or loses their device without exporting first, that conversation history is gone permanently — for everyone, including administrators. There is no recovery path, by design. Make sure users understand this before you enable it.

Availability

Company key is available on any deployment. User key additionally requires the zero-knowledge rollout flag (ENABLE_PZK / NEXT_PUBLIC_ENABLE_PZK) to be switched on for the deployment; it is enabled in the standard staging and production configurations. Where it is off, the user-key option is shown as unavailable and the API rejects it, so a conversation can never be labelled private while actually sitting on disk unencrypted.

Changing the Storage Mode

Go to Admin → Security Hub → Chat Privacy (/admin/chat-privacy). The page is restricted to ACCOUNT_OWNER, ACCOUNT_ADMIN, ADMIN, SECURITY_CUSTODIAN and super-admins, and every API route behind it enforces the same gate.

Three things happen when you change the mode:

• A pre-flight check runs. Switching to company key verifies that your company's encryption key can actually be provisioned before committing the change, so a key-management misconfiguration surfaces to you immediately rather than silently to a user on their next message.
• Every change is written to the audit log, with a distinct action when the mode itself changes rather than only the surrounding settings.
• Every user's privacy-notice acknowledgement is invalidated, so users are told about the new posture the next time they open chat.

Existing conversations keep their original mode

The storage mode is a snapshot taken when a conversation is created. Changing the company setting never re-encrypts, re-writes or reclassifies conversations that already exist — only new conversations pick up the new mode. Plan for a transition period in which both old and new conversations coexist under different modes, each showing its own accurate badge.

Retention and Shield-Masked History

Two further settings sit on the same page and apply independently of the storage mode:

• Chat history retention (days) — separate from the general data-retention setting, because chat is free text and routinely contains your own customers' data. Leave it empty for no limit.
• Persist Shield-masked history — when Shield sanitization ran on a turn, store the masked text ([PERSON_1]) instead of the restored answer. It is restored on read through the conversation's sanitizer session, which has its own expiry; after that, history shows an explicit "identities no longer resolvable" marker rather than a bare token.

The Privacy Badge

Every chat conversation header shows a small badge next to the Shield toggle:

Badge	Icon	Meaning
Private to you	Shield (emerald)	Nobody at your organization can read this conversation — not the server, not an administrator.
Visible to your organization	Eye (amber)	Your organization's administrators can access this conversation.

The badge is never colour-only — it always pairs an icon with a label, and hovering it explains the concrete reason (for example, "your company has oversight capture enabled for chat" or "history is stored under a company key").

Why the badge can say "visible" even under user key

The badge is computed live, not read off a single setting. A conversation is only ever shown as Private to you when none of the following apply:

• The conversation's storage mode is anything other than user key.
• Compliance Oversight is enabled for your company and configured to capture chat interactions.
• HIPAA mode is active for your company and configured to retain transcripts.
• An administrator holds an active recovery key share on the conversation's encryption key.

If any of these apply, the badge reads Visible to your organization — even under user key. This is deliberate: a green "private" badge over a conversation your employer can still read through oversight capture would be a false assurance, not a convenience.

The Privacy Notice

The first time you open the chat terminal, or any time after your company's chat storage mode changes, you'll see a one-time notice explaining the current posture in plain language. Acknowledging it dismisses the notice until the mode changes again — this is separate from (and in addition to) the general corporate-use oversight notice, which covers whether your employer records your AI activity at all. The privacy notice answers a narrower question: what happens specifically to your chat history.

How This Interacts With Other Settings

Your company has...	Badge shows
Plaintext storage, no oversight	Visible to your organization
Company-key storage, no oversight	Visible to your organization (encrypted at rest, but admins hold the key)
Any storage mode + Shield surrogate-space history	Unchanged by this setting (Shield still masks PII in what's stored)
Compliance Oversight enabled for chat	Visible to your organization
HIPAA mode with transcript retention	Visible to your organization
An admin holds a recovery key share	Visible to your organization
User-key storage, none of the above	Private to you

Learn More

• Compliance Tools — Compliance Oversight and regulatory features
• PII Sanitization — Shield's masking of sensitive data before it reaches a provider
• Zero-Knowledge Encryption — the encrypted-storage model that user-key chat history is built on
• Data Privacy & Training Policies — how provider-side data handling is tracked separately from storage