AdaptAI ConsultingVisit Website →
← Back to blog

Chatbot Security: How to Protect Your Business and Customers

November 6, 2026
Chatbot Security: How to Protect Your Business and Customers

A secure chatbot does four things: it collects only the data it needs, it can only reach the systems and actions you have approved, it treats everything users type as untrusted, and it leaves a log you can review when something goes wrong. None of that requires a large security team. It requires decisions made before launch, not after. Below, we walk through the risks, the Canadian rules that apply, how authentication and access should work, and how to monitor a bot once it is live.

AdaptAI
Build a More Connected Operation
AdaptAI builds custom software for businesses seeking connected operations, with ongoing AI training to help teams make better use of their technology.
Explore AdaptAI

Table of Contents

What are the main security risks of a business chatbot?

The short answer: data leaving your control, a bot being tricked into doing something it shouldn't, and people trusting wrong output without checking it.

The Business Development Bank of Canada lists several risks that matter to a small business:

  • An employee pastes sensitive information into an AI tool nobody has vetted, and it leaves your control.
  • A provider uses submitted information to train its models, so sensitive details could surface in other users' answers.
  • Prompt injection: hidden instructions in content the chatbot reads change how it behaves.
  • Acting on faulty AI output with no human oversight.

Prompt injection deserves a plain explanation. A chatbot follows instructions written in everyday language. If a customer message, an uploaded document or a web page contains text that looks like an instruction, the bot may follow it. The OWASP AI Agent Security Cheat Sheet advises treating all external data as untrusted, including user messages, retrieved documents, API responses and emails, and keeping clear boundaries between instructions and data.

The Office of the Privacy Commissioner of Canada adds a customer-side view. Information may be stored without a clear explanation, may be used to train the system, and a chatbot could disclose what it has learned about one user to another.

Small businesses are exposed in a particular way. The New Zealand National Cyber Security Centre notes that limited resources and technical expertise can leave small firms without strong data governance. That makes accidental leaks through cloud-based AI tools and misuse of customer data by third-party providers more likely. The fix is not fear. It is a short list of controls applied consistently.

If you want a broader, non-technical view of where your data goes when staff use AI tools, see our plain guide to business data and AI tools.

What does Canadian privacy law expect from your chatbot?

If your chatbot handles personal information in the course of commercial activity, federal privacy law is likely to apply. Whether PIPEDA or a provincial law covers you depends on your situation, so confirm with a privacy lawyer or the Privacy Commissioner's office. Here is what the sources say.

Breach reporting. Under section 10.1 of PIPEDA, as added by the Digital Privacy Act, an organization must report to the Privacy Commissioner a breach of security safeguards involving personal information under its control when it is reasonable to believe the breach creates a real risk of significant harm. It must also notify the affected individual.

What a report contains. The Breach of Security Safeguards Regulations require a written report describing the circumstances and cause, when it happened, what information was affected, how many people, the steps taken to reduce harm and to notify people, and a contact person. You must also keep a record of every breach for 24 months after you determine it occurred. A chatbot that logs nothing makes this very hard to do.

Transparency and consent. The Privacy Commissioner's guidance on AI and your business says organizations using generative AI should:

  • label when generative AI was used to create content or make decisions;
  • establish legal authority for collecting and using personal information;
  • make sure consent is valid and meaningful;
  • be open about how information is used and the risks involved;
  • limit sharing of personal, sensitive or confidential information;
  • build privacy in from the start.

In practice, that means a visible notice at the top of the chat saying the user is talking to an AI, a short statement of what is collected and why, and a link to your privacy policy.

For a worked example of a privacy-conscious rollout, our 30-day pilot for a privacy-safe knowledge base chatbot shows the steps in order, and our piece on piloting AI without ignoring PIPEDA covers workflow tools.

How should chatbot authentication and access controls work?

Authentication for a chatbot has two sides: who is allowed to use the bot, and what the bot is allowed to do on their behalf. Most real incidents come from getting the second side wrong.

Who is the user?

A public-facing bot that only answers general questions about opening hours needs no login. The moment it can show an order, an invoice or an appointment, it must verify the person first, ideally through the same login your customers already use rather than by asking for details in the chat. Do not let the bot decide identity from what someone types.

For your own staff and administrators, the Canadian Centre for Cyber Security recommends multi-factor authentication (MFA) on accounts and devices to prevent unauthorized access to high-value resources and sensitive data. ISACA's 2026 recommendations likewise call for MFA for operators and administrators of AI agents.

What can the bot itself do?

Treat the chatbot as a separate user of your systems with its own narrow permissions. ISACA's guidance, summarized here, includes:

  • a separate identity for each agent, with no shared accounts or long-lived tokens;
  • short-lived credentials that rotate automatically;
  • least-privilege access to every tool, API, knowledge source and data store;
  • role-based access, with just-in-time elevation for sensitive functions;
  • separate identities for human users and the agent's runtime;
  • authorization checks on memory retrieval and context access.

The Cyber Centre's guidance on agentic AI goes further for developers. Each agent should be its own principal with a cryptographically anchored identity, calls between agents and services should be authenticated with mutual TLS, and anything not in a trusted registry should be denied. It also says organizations should never grant broad or unrestricted access, and should prevent agents from executing high-impact actions without prior human approval. Human review is specifically called for on system resets, network egress, deletion of critical records, and requests to delete logs or audit records.

A simple test for a small business: if the bot were a new part-time employee, would you give them this much access on day one? If the answer is no, narrow it.

Which chatbot security practices matter most?

Here is a practical order of work, drawn from Canadian government guidance and professional bodies.

  1. Collect less. The Australian and New Zealand cyber agencies advise limiting data collection to what the chatbot's function needs. The Government of Canada's design guidance goes further: remove or redact personal information in the input field rather than sending it to the AI service or storing it, and set default retention periods with deletion at the end.
  2. Treat every input as untrusted. The Cyber Centre's top 10 AI security actions include sanitizing inputs, isolating system prompts, filtering outputs, and validating downstream actions before they run.
  3. Limit what the bot can reach. The same guidance recommends reducing the AI model's access to private data, limiting exposure to untrusted content, and reducing its ability to communicate externally.
  4. Protect data in transit and at rest. The same document calls for classifying and minimizing personal information in prompts, encrypting data, and applying access controls and retention limits.
  5. Keep a human in the loop for high-stakes answers. For legal, medical or financial advice, the Australian and New Zealand guidance recommends human oversight. A bot that books appointments is low risk. A bot that quotes a refund policy or gives tax guidance needs a handoff to a person.
  6. Write an acceptable-use policy. The Cyber Centre's generative AI guidance recommends a risk plan covering how AI is used and what content may be generated, with oversight and review. The top 10 actions add policies to govern unsanctioned "shadow AI" and allow and deny lists for AI tools.
  7. Patch and update. Turn on automatic updates and fix known exploited vulnerabilities as soon as possible, as the Cyber Centre advises.

Two cautions on sequencing. First, do these before you connect the bot to your CRM or invoicing, not after. Second, start with low-risk tasks. The Cyber Centre recommends using agentic AI only for low-risk, non-sensitive tasks until oversight and evaluation methods mature. Answering common questions from a vetted knowledge base is a sound first step, and our guide to building an internal AI chatbot safely shows how.

How do you test, monitor and respond to incidents?

Security does not end at launch. A chatbot behaves differently as content, users and connected systems change.

Test with hostile input. Before going live, have someone try to make the bot reveal its instructions, ignore its rules, or pull another customer's data. Repeat after every significant change to the bot's prompts, tools or data sources.

Log what matters. ISACA recommends logging prompts, responses, retrieved sources, tool invocations, approvals, identity context and policy violations, with redaction where needed, in centralized, tamper-resistant storage. The Government of Canada's design guidance adds that audit logs should have role-based access so only people with a need to know can read them. Logs contain customer conversations, so they are themselves something to protect.

Seven security details to capture in chatbot logs

Have a playbook. Write down, in one page, who decides to take the bot offline, who contacts customers, and who assesses whether the breach reporting threshold under PIPEDA is met. ISACA suggests escalation and containment steps such as disabling tools or switching the agent to read-only mode. That second option is useful: you can keep answering questions while removing the bot's ability to change records.

Watch for misuse. The design guidance also advises monitoring for inappropriate uses and keeping up with defences against prompt injection, model inversion and jailbreaking.

How do you choose a chatbot platform or vendor safely?

Most small businesses will use a hosted platform or a custom build rather than create a model. Either way, the contract and settings are part of your security.

  • Review the configuration settings, terms and privacy policy of any AI platform, as the NZ National Cyber Security Centre recommends, to understand how your data may be collected, stored and used.
  • Ask whether submitted conversations are used to train models, and whether you can opt out.
  • Look for clear clauses on data protection, breach notification and uptime in the contract.
  • Ask where data is stored and how long it is kept.
  • Ask what actions the bot can take in your systems and whether you can restrict them.

The Cyber Centre's guidance also asks readers to weigh whether a purpose-built tool would be of higher value than third-party products, and to consider whether AI is necessary for the task at all. For a side-by-side look at choosing a chatbot platform and what each use case lets the bot handle, that comparison is a good place to start. If you are still deciding whether a bot is the right tool, our comparison of chatbots and live chat and our look at chatbots versus hiring staff can help.

Our perspective: security is a design decision, not an add-on

Most chatbot problems we see are not clever attacks. They are ordinary shortcuts: a bot connected to everything because it was easier, a staff member pasting a client list into a public tool, a log nobody planned for.

That is why we build around your actual processes and data rather than bolting a generic widget onto your site. When the chatbot, CRM, scheduling, invoicing and reporting sit behind one login, you can decide in one place who sees what and what the bot may touch. Fewer disconnected tools means fewer places for customer data to leak.

Our approach is to start small, with low-risk tasks, fixed pricing and regular milestones, so you can see how the bot behaves before it gets more responsibility. Clients own the code and there is no lock-in, which means your security choices stay yours. And we train your team on real tasks, because the most common leak is a person, not a system.

I would rather tell you a bot is not ready for a task than promise something it cannot safely do.

Harry Gill

Want a chatbot built with these controls?

AdaptAI designs AI chatbots and customer service tools for small and medium businesses in Surrey and Metro Vancouver, scoped with fixed pricing and local support. If you want a second opinion on risk before you build, our AI strategy and pilot services are a practical place to begin.

AdaptAI

If your team already uses AI tools without clear rules, our AI training and workshops cover safe use on the tasks your staff actually do.

FAQ

Is a customer-service chatbot a privacy risk under Canadian law?

It can be, if it collects personal information. You need legal authority to collect it, meaningful consent, and openness about how it is used, according to the Privacy Commissioner's guidance. If a breach creates a real risk of significant harm, PIPEDA requires you to report it and notify those affected. Ask a privacy lawyer how the law applies to your business.

Do chatbots need authentication?

Only if they show or change personal or account information. In that case, verify the user through your existing login rather than through details typed into the chat. Staff and administrators who manage the bot should use multi-factor authentication, as the Cyber Centre recommends.

What is prompt injection, in plain words?

It is when text the bot reads, such as a message, a document or a web page, contains hidden instructions that change what the bot does. The defences are to treat all outside content as untrusted, limit what the bot can access, and check actions before they run.

Should employees paste customer data into public chatbots?

No, unless you understand what the tool does with it. The Cyber Centre advises against sharing private information with AI tools without that understanding. Set an acceptable-use policy and give staff an approved alternative.

Sources