Security is the architecture, not a checkbox.
Most vendors secure a system that generates answers live, then hope nothing slips through. Truebe removes that step entirely — there's no generation to secure, because nothing is ever generated.
How it holds up
Five principles, true across both products.
Whether you run the WordPress plugin or Truebe Sovereign, the same rules apply.
✓Your data never leaves your infrastructure
The WordPress plugin stores everything in your own WordPress database. Sovereign runs on your own server. Truebe is never in the data path.
✓Your own AI key
You connect your own Claude or OpenAI key. The call runs from your server to your provider — Truebe never sees the content of the call.
✓Encrypted at rest
Your AI provider key is encrypted with AES-256-GCM before it's stored — on Sovereign, so are Calendly, Zendesk, and Twilio credentials. There is no plaintext fallback — if encryption fails, the system refuses to save the credential rather than storing it unprotected.
✓Full audit trail
Every approved answer records who approved it and when. Sovereign adds a cryptographically chain-verified export a regulator can confirm was never altered.
✓Nothing is ever generated
The AI interprets a question but never writes the answer. Every response is text your team wrote and approved in advance — there is no live-generation step to secure in the first place.
✓Hardened against the standard attacks
Every database query is parameterized against SQL injection. Visitor input is rendered as text, never as HTML, closing the door on cross-site scripting. Every admin action is checked against a nonce and your WordPress permissions before it runs.
✓Two-factor enforced on sensitive screens
Truebe doesn't build its own two-factor authentication — it verifies a maintained 2FA plugin is active on your site and locks screens handling sensitive data until one is.