Trust & security
Built for businesses where a wrong answer costs more than the software.
Review Fred’s configured guardrails and data-handling controls. Confirm the settings, detection limits, and escalation workflow for your deployment, and test before launch.
One bad answer is all it takes.
An airline’s chatbot invented a refund policy, and a court held the airline to it. The bot’s words were the company’s words. That ruling is why Fred is built the way it is: when an AI speaks for your business, “the model usually behaves” is not a safety plan.
Architected guardrails
- Rules enforced in code, before Fred ever speaks
- Checked on the way in and on the way out
- Logged, so you can see what was blocked and why
- Industry, regional, and custom rules stacked together
When the moment needs a person
- Configured crisis patterns are designed to surface crisis resources
- Emergency and safety language can trigger a configured team escalation
- Complaints and disputes can be routed to a configured team destination
Prompt guardrails (most bots)
- A paragraph of instructions the model can ignore
- One clever question away from a viral screenshot
- No record of what was blocked, or why
Review the industry, regional, and custom rules available for your deployment. Confirm which rules are active and how conflicts or missed patterns are handled.
Four areas to review before launch.
These controls help define what Fred should answer, how information is handled, and when your team should review a conversation.
Fred stays in your lane
Scope discipline is designed to block code-for-hire, jailbreak attempts, and off-topic abuse. More than 50 industry and regional packs add configured rules for a business and its region. Crisis patterns are enabled by default to surface appropriate resources and support human escalation, but Fred is not an emergency service.
Your keys, your data, your provider
Fred uses your connected provider account for AI services. Provider handling of inputs and outputs depends on the service, account tier, region, terms, and settings. Review those choices before sending business or visitor data.
Configure visitor-data controls
Configure redaction, retention, and connected destinations for your deployment. Confirm which data paths those settings cover. Regional packs are configuration aids; they do not establish legal compliance. See the regional rules →
See what was blocked, and why
Review which guardrail events your deployment records and what those records contain. For integrations that support shared-secret signing, enable it and verify signatures at the receiver. A recorded event or valid signature does not confirm human receipt or follow-up.
Want the layer-by-layer tour, baseline to custom rules? See how the guardrails work
Architected trust. Not prompt theater.
Talk to Fred.
The defaults, in plain English.
Review the active settings for your business, region, and channels. Test the safeguards and escalation destinations before launch.
Sensitive-data handling
- Review credential storage and access for the selected deployment
- Confirm retention across conversations, diagnostic data, and backups
- Use the appropriate payment channel; avoid collecting card details in general chat
- Confirm the behavior of your selected consent and capture settings
Topics for configured team escalation
- Configured crisis language, with resources surfaced and escalation supported
- Threats, emergencies, and safety situations
- Complaints and disputes that deserve a person
Topics addressed by configured refusal rules
- Recognized jailbreak and prompt-injection patterns
- Code-for-hire, homework abuse, and off-topic drift
- Requests for Social Security or card numbers in chat
- Hate, fraud, and anything involving a child
In a regulated industry? Fred is built for healthcare, finance, and legal compliance workflows, with a pre-built pack for your field. Find your industry
For your security reviewer.
How is data encrypted?
Review security controls for the deployment and data involved: provider credentials, conversations, uploads, indexes, and backups. Fred Cloud and a plugin on your own hosting have different operating responsibilities. Contact us to review the requirements for your deployment.
What happens to PII?
Redaction targets configured patterns and can miss information. Consented contact fields may need to reach your CRM, while other sensitive data belongs in a secure channel. Review field mapping, redaction coverage, and retention for each connected system.
What about retention, consent, and privacy law?
Confirm transcript retention, consent records, access, export, and deletion settings for your deployment and connected services. Discuss your organization’s requirements and available processing agreements before collecting visitor data.
How do you handle prompt injection?
Configured rules run outside the AI model and target recognized jailbreak and off-topic patterns. Detection can miss new or ambiguous phrasing. Review permitted integrations and destinations for your deployment; do not treat these controls as a guarantee against every misuse.
Are CRM webhooks secure?
Webhook deliveries to platforms like n8n, Make, or your own endpoint can carry a shared-secret HMAC signature, so your systems can verify each payload came from Fred and was not altered in transit. Direct CRM connections like HubSpot, Salesforce, and Zoho authenticate with your CRM’s own credentials, so signing follows what each platform supports. Lead data lands in your CRM, not in a third-party inbox.
How does the WordPress plugin ship?
Through a protected build pipeline with signed, tamper-resistant distribution. What arrives on your site is what we shipped, verified cryptographically, with updates delivered the same way.
What does Fred Cloud add?
The same guardrail and privacy model, plus managed infrastructure and request tracing with OpenTelemetry for operations teams. Fred Cloud is available now. See Cloud plans
Put it in front of your compliance team.
Request the compliance documents, or bring your reviewer’s questions straight to us. Fred is in the corner of this page if you want to test the boundaries yourself.