Security and data
Hosted in Germany. Written down in public.
muro runs on servers in Nuremberg. The DPA, the sub-processor list and what the widget stores are public, so you can check where your visitors' data goes before you sign up.
The short version
- Servers and database
- Hetzner, Nuremberg, Germany
- Backups
- Local at Hetzner, plus an off-site copy encrypted with AES-256 before upload
- Amazon SES, Ireland
- AI
- Off per site, or on your own Anthropic key
- DPA
- Public and pre-signed by muro, you countersign
- Sub-processors
- Public list, 30 days notice before a new one
Hosted in Germany
Your conversations are stored in Nuremberg.
Application servers, the database, the inbound mail server and local backups run at Hetzner in Germany. A short list of providers handles the rest, each one named with its purpose and the safeguard for any transfer outside the EU.
Stripe handles subscription billing for workspace owners and never receives visitor data. Purposes, data categories and safeguards for each provider are on the sub-processors page.
Encrypted in transit
Dashboard, widget and API traffic is served over TLS. Cloudflare sits in front of muro.chat for DNS and DDoS protection, and TLS ends at its edge.
Encrypted backups
Backups are encrypted with AES-256 on our servers before an off-site copy goes to Cloudflare R2, which cannot read them.
No third-party analytics
Error tracking and analytics run on our own servers, not with an outside provider.
Privacy-minimal widget
The widget keeps what a conversation needs, and drops the rest.
It runs in your visitors' browsers, so it is built to collect little. The server enforces these rules on every request, whatever an old cached copy of the script sends.
- No cookies. Five keys in localStorage, all erased 13 months after the first one was written.
- Load it with
lazy: trueand it reads, writes and sends nothing until the visitor opens the chat. - Only the latest page address is kept per visitor.
- Browser, system and device type come from the user agent, the country from the network edge.
- No third-party analytics, no ads, no cross-site tracking.
Page address
Query string and fragment dropped. Domain only or nothing, if you prefer.
IP address
Cut to its network. IPv6 is cut to /48.
Visitor ID
Not a device fingerprint: nothing about the browser goes into it.
Name and email
Or what your site passes with identify().
AI you control
AI sees a conversation only where you turn it on.
The AI switch is per site. Keep it on for your docs site and off for a client site. When it is off, nothing from that site reaches the AI provider.
AI off
Nothing from the site is sent to an AI provider. Your team answers every message.
Reaches the AI provider
Nothing
AI on, with plan credits
Anthropic processes the conversation in the US under standard contractual clauses. Every AI reply is labelled as AI.
Reaches the AI provider
Message content, site name, visitor name if given. Never page addresses or IP addresses.
AI on your own key
Requests run on your Anthropic account, under your own agreement with them. muro stores the key encrypted with AES-256-GCM.
Reaches the AI provider
The same, on your account instead of ours.
To track AI usage, muro keeps token counts, never message content, for 180 days.
Accounts and access
Locked down inside the app, too.
Your whole team signs in to muro, and some of you connect scripts and AI agents to it. These are the controls behind that.
Two-factor sign-in
TOTP codes from any authenticator app, with 10 single-use recovery codes.
Throttled sign-in
Sign-in, sign-up and password reset are rate-limited per IP address to slow down password guessing.
Sessions you can end
See where you are signed in and sign a device out. A password reset signs out every other session.
Audit log
Sign-ins, API keys, exports, erasures, billing, settings and webhook changes each leave a row. Kept 90 days.
Scoped API keys
Stored as SHA-256 hashes. Read-only unless you add write, optionally limited to one site, optionally set to expire.
Workspace isolation
Every read and write is scoped to your workspace. Each session and API key is bound to a single workspace.
Signed visitor tokens
The server signs a token for each visitor and site, so one visitor cannot post or identify as another.
Signed webhooks
Deliveries carry an HMAC-SHA256 signature. Webhook URLs cannot point at private or internal networks.
GDPR
Export or erase a visitor from the dashboard.
Your visitors exercise their rights with you, as the site owner. The tools to answer them are in the dashboard, not behind a support ticket.
- Export any visitor from their page in the dashboard.
- Erase a visitor and muro deletes them, every visitor in the workspace with the same email, and all their conversations, right away.
- Export your workspace data or delete the workspace from Settings.
- If one of your visitors writes to us, we forward the request to you and help you answer it within the legal deadline.
Paperwork
Read the documents before you sign up.
No sales call and no form to fill. The DPA is pre-signed by muro: request your copy and countersign.
Data Processing Agreement
GDPR Article 28 terms, pre-signed by muro. Breach notification within 72 hours.
Sub-processors
Every provider, what it does, which data it sees, where, and the transfer safeguard.
Privacy policy
What we collect from you and from your visitors, the browser keys, and retention.
Terms of service
What the service does, acceptable use, billing, cancellation and liability.
Certifications
muro is not SOC 2 or ISO 27001 certified. This page lists what is in place, not what is planned. If your review comes with a security questionnaire, send it over.
Responsible disclosure
Found a security issue? Tell us first.
Email contact@muro.chat with what you found and the steps to reproduce it. We do not threaten or sue researchers acting in good faith.
In scope
muro.chat and everything served from it: the dashboard, the widget, the REST API and the MCP server.
Email a report