Security Guidelines for Passing Visitor Context

Last updated: August 11, 2026

Pass only the visitor information the Marketing Agent needs and that your organization allows it to use during a conversation.

How Docket Protects Pending Context

The widget encrypts Dynamic Context in the browser before storing the pending payload. The current implementation uses AES-256-GCM for the data and RSA-OAEP with SHA-256 to encrypt the generated AES key.

The encrypted payload is buffered in browser storage until Docket creates the conversation. After the backend acknowledges the context, the widget clears the pending buffer. If conversation creation fails, the buffer is retained so the request can be retried.

Encryption does not make every type of visitor data appropriate for an AI conversation. Your privacy, consent, retention, and access policies still apply.

Never Pass These Values

  • Passwords or authentication secrets

  • API keys, access tokens, or session tokens

  • Payment-card or bank-account details

  • Government identifiers

  • Private encryption keys

  • Sensitive internal notes that the visitor should not hear

  • Complete records when a smaller classification or identifier is sufficient

Prefer a safe derived value. For example, send hasPaymentMethod: true rather than payment details.

Minimize the Payload

Use only fields that change the agent's behavior or remove a question the visitor already answered.

const result = await window.AISeller.setContext({
  accountId: "acct_12345",
  plan: "Enterprise",
  isCustomer: true,
  region: "North America"
});

Avoid sending a complete CRM, support, or product-usage record when four fields are sufficient.

Protect URL Context

Values sent through ctx_ URL parameters can appear in browser history, analytics tools, referrer data, screenshots, and server logs. Use URL context only for values that are safe to expose in those systems.

For values that should not appear in a URL, call setContext() from website code instead.

Manage Visitor Identity

  • Call resetContext() when a visitor logs out or changes identity.

  • Set a complete new context object before the next conversation.

  • Do not rely on a previous visitor's buffer in a shared browser.

  • Review context fields when your privacy or data-use policy changes.

Review Checklist

Before deploying a context field, confirm:

  1. The agent needs the field for a documented purpose.

  2. The visitor or your organization has authorized that use.

  3. The field description prevents the agent from exposing or repeating it unnecessarily.

  4. The value is not a secret or regulated identifier.

  5. Website logs, analytics, and URLs will not expose it unexpectedly.

  6. Your logout and identity-change flows reset stale context.

Related Articles