Security Overview
betterfound is designed for enterprise storefronts that require strong security posture. This section covers how betterfound authenticates outbound traffic, how to configure your firewall and WAF, what data betterfound stores, and how to rotate credentials.
What betterfound sends to your infrastructure
Once a shopper triggers the assistant, betterfound makes two kinds of outbound HTTP requests:
| Pattern | Origin | Destination | Purpose |
|---|---|---|---|
| Catalogue fetch | betterfound region (EU/US, fixed CIDRs) | Your product API | Pull structured product data per shopper query |
| fetch_url | betterfound region | Pages on your brand website host only | Pull text excerpts from PDPs / FAQs when the catalogue lacks detail |
Only fetch_url traffic typically reaches your WAF in a way that triggers bot protection. Catalogue fetches go to whatever URL you provided during setup.
Volume profile
- ≤ 4 requests / second / tenant, contractually capped server-side
- ≤ 2 fetch_url calls per shopper question
- All requests are GETs over TLS 1.2+. No POST / PUT / DELETE traffic
- No cookies, no JavaScript execution, no follow-up asset fetches
- Truncate handling: betterfound reads ≤ 200 KB raw HTML per page, then strips to ≤ 6 KB plain text before sending to the LLM
Security sections
| Topic | What it covers |
|---|---|
| Authentication & Signing | HMAC-SHA256 request signing, the four standard headers, replay protection, verification code |
| Firewall & WAF | Tier A (public allow-list) and Tier B (dedicated endpoint), WAF rules for Cloudflare, AWS, Akamai, Imperva |
| Data Handling | What is stored, retention periods, LLM data policy, SOC 2, GDPR |
| Secret Rotation | Zero-downtime rotation procedure, overlap window, dashboard steps |
A 30-minute review of the Firewall & WAF and Authentication pages with your platform team is sufficient to land a production-ready integration.
Contacts
- Integration issues: security@betterfound.ai
- CIDR change notifications: subscribe at
https://betterfound.ai/ips.json(30-day notice for any new range) - Incident response: PagerDuty integration available on request