Security and Data Boundaries - Docs menu

Security and Data Boundaries

Use this page to understand the main customer-visible boundaries in Navigic.

Embed Keys

Embed keys have two parts:

  • The publishable key can be used in browser code.
  • The secret key must stay on your server and is only used for identity verification.

Never put the secret key in client-side code.

Allowed Origins

Allowed origins restrict which websites can use an embed key. Add only domains you control.

Related guide: Allowed Origins.

Knowledge

Do not add passwords, private API keys, or unrelated sensitive records to agent knowledge. Use your own secret manager or approved integration settings for credentials.

Review Boundaries

Keep human review for:

  • Refunds and commercial exceptions.
  • Sensitive customer commitments.
  • Policy or compliance decisions.
  • Medical, legal, financial, or safety-sensitive responses.
  • Durable memory or knowledge updates that could affect future users.

Internal Infrastructure

Customer docs should explain product behavior and visible controls. They should not require you to understand Navigic's internal hosting or storage implementation.