Embedding chat as a first-party script on the host page is convenient — and risky. Anything on the page can read the DOM, hook network calls, or skim message text.
The risk of placing chat in the host-page DOM
Lavenity keeps the conversation UI on our origin inside an iframe. Your site’s scripts never get a handle on message contents, and a compromised theme or third-party tag cannot quietly exfiltrate the thread.
The parent page only loads a tiny bootstrap script that opens the frame and passes the site ID. Cross-origin boundaries do the hard isolation work that same-page widgets cannot.
How iframe creates a cross-origin boundary
On top of that we sign visitor tokens so history cannot be forged, restrict the widget to allowlisted domains, apply a strict Content Security Policy, and rate-limit abusive traffic before it reaches your inbox.
If you run a security review, start with the iframe boundary, token signing, and domain allowlist — those are the controls that matter most for a chat embed.
CSP, tokens, and allowlists as additional layers
For personal-data questions, see our Privacy Policy. For the operational checklist, open the Security page.
What to verify during a security review
Confirm that the parent page cannot read the chat DOM and that the iframe can only be embedded by approved domains. Review site ID transfer, postMessage origin validation, visitor-token signing and lifetime, and the behavior after a domain is removed from the allowlist.
Review Content Security Policy, attachment routes, and rate limits separately. Iframe isolation reduces the surface available to third-party scripts, but it does not replace authentication, origin checks, logging, or abuse controls. Security comes from several independent layers rather than one magical boundary.
Frequently asked question
Does iframe make the chat completely secure on its own?
No. Iframe provides an important cross-origin boundary, while Lavenity also uses signed visitor tokens, domain allowlists, strict CSP, origin validation, and rate limiting. The protection comes from these controls working together.