Trust Center
Security, privacy and compliance for uWebChat, in one place. Everything on this page comes from our data processing agreement.
Version 2.0, in force since 1 August 2026. No form, no sign-up.
How a conversation flows
uWebChat relays messages. It does not keep them. Your conversations live in your own Microsoft 365 tenant.
- 1
Visitor starts a chat
A visitor writes in the uWebChat widget on your website.
- 2
uWebChat relays the message
The uWebChat service on Microsoft Azure in the Netherlands passes the message on. The conversation history is held only in working memory, never in a database or file.
- 3
Your team answers in Teams
The message arrives in Microsoft Teams in your own Microsoft 365 tenant, where your retention, eDiscovery and Purview settings apply.
- 4
Transcript where you want it
Transcripts go to your own OneDrive, to the visitor as a download, or by e-mail, as you configure.
What is kept, and for how long
- Message content
- Not stored by uWebChat. Held in working memory during the chat and removed when it ends; chats that are not ended properly are removed after at most 8 hours of inactivity.
- Session data (visitor name, contact details, IP address)
- Removed when the conversation is disconnected, and in any case after one day of inactivity.
- Technical metadata (conversation ID, agent, start and end time)
- Kept for licence administration and reporting. Contains no message content.
- Application logs
- Never contain message content. May hold technical details at the moment of an error, such as a display name or IP address. Stored in Azure West Europe and deleted after at most 90 days.
- Conversations, transcripts and archives in Teams and OneDrive
- Stay in your own Microsoft 365 tenant, under your own retention policies.
The chat widget in your visitor's browser
- Nothing is stored in the visitor's browser before a chat starts.
- When a chat starts, a randomly generated chat user ID is stored in local storage.
- When an agent connects, two functional cookies are set for 30 minutes, so the chat continues on the next page.
- All three are removed when the session ends.
- The chat window has no analytics or tracking. All scripts are hosted by uWebChat or Microsoft.
AI and your data
- The virtual assistant uses Azure OpenAI in your own Azure tenant, under your own agreement with Microsoft.
- Prompts and answers are not used by uWebChat to train AI models.
- Real-time translation and speech to text run on Microsoft Azure in West Europe, only when you switch them on. Text is translated without being stored.
- Shared images and files are checked for harmful content before delivery.
Sub-processors
Microsoft 365, Microsoft Teams, OneDrive and Azure OpenAI in your own tenant are contracted by you directly and are not sub-processors of uWebChat. Changes to this list are announced by e-mail to the licence administrator at least 30 days in advance.
Security measures
- Information security management system certified against ISO/IEC 27001:2022, with annual internal and external audits.
- Access to the platform only for authorised staff, with multi-factor authentication.
- A secure development process under our ISO 27001 management system.
- Continuous logging and monitoring of the platform.
- Tenant isolation: conversations are only delivered to agents in your tenant and to the domains registered for your licence.
- Abuse protection: agents can ban visitors and you can block countries. Optional visitor authentication with a one-time code.
- Suppliers and sub-processors are assessed at least once a year.
Your rights and our commitments
Data subject requests
Conversations live in your Microsoft 365 tenant, so you can handle most requests yourself with Teams, OneDrive and Microsoft Purview. For data held by uWebChat we help within ten working days.
Data breaches
We notify you without undue delay, where possible within 48 hours, by e-mail and phone to your licence administrator.
End of contract
Within three months we delete the personal data we process for you.
Questions about security or privacy?
Our Security Officer is happy to help, for example with a security questionnaire or a supplier assessment. Send your question through the contact form.
Go to the contact formSecurity and privacy FAQ
Is a data processing agreement (DPA) available?
Yes. Download it from this page, no form needed. It is the GDPR Article 28 agreement: the uWebChat Data Pro Statement plus the NLdigital Standard Clauses for Data Processing.
Does uWebChat store our chat conversations?
No. uWebChat relays messages between the visitor and Microsoft Teams in your own Microsoft 365 tenant. The conversation history is held only in working memory during the chat and removed when it ends. Your conversations stay in your Teams environment, under your own retention settings.
Where is our data hosted?
On Microsoft Azure in the West Europe region (the Netherlands), including data storage, key management and logging. Personal data is processed within the EU/EEA. Message delivery to Teams uses a global Microsoft service that does not store message content and falls under the Microsoft EU Data Boundary.
Do you store the visitor's IP address?
Only during the session, for the ban function and the country blocklist. It is removed when the conversation is disconnected, and in any case after one day of inactivity. Application logs can contain an IP address at the moment of an error; they are deleted after at most 90 days.
Can visitors chat anonymously?
That is up to you. You decide which fields visitors are asked to fill in, such as e-mail address, phone number or company, and whether they must confirm their e-mail address or phone number with a one-time code.
Is our data used to train AI models?
No. The virtual assistant runs on Azure OpenAI in your own Azure tenant, under your own agreement with Microsoft. uWebChat does not use prompts or answers to train AI models.
Is uWebChat certified?
Yes. uWebChat is developed and operated by Universal IT B.V. under an information security management system certified against ISO/IEC 27001:2022 by Kiwa Nederland B.V. (certificate K-0221887, valid until 16 December 2027).
Start answering website visitors from Microsoft Teams
Free for 1 agent, no credit card. Install the app in Teams and your first chat is live in minutes.