{"slug": "show-hn-chatty-open-source-ai-support-engine-with-woocommerce-sync", "title": "Show HN: Chatty – Open-source AI support engine with WooCommerce sync", "summary": "PersonaliAI released Chatty, an MIT-licensed, self-hostable open-source AI customer support engine positioned as a Zendesk and Intercom alternative, with WooCommerce sync, WhatsApp and Slack channels, and an included 81-tool FastMCP server supporting OAuth 2.0 PKCE and API keys. Chatty runs application containers on a user's own Docker host (VPS, Railway, or Render) while keeping Supabase Auth, Postgres, Storage, and Realtime managed, and supports bring-your-own-key LLM access to Gemini, OpenAI, Claude, OpenRouter, or local models. The project offers self-hosting for $0 under the MIT license or a hosted Chatty Cloud tier with a free 14-day trial.", "body_md": "[English](https://github.com/PersonaliAI/chatty/blob/main/README.md) ·\n  [简体中文](https://github.com/PersonaliAI/chatty/blob/main/README.zh-CN.md) ·\n  [日本語](https://github.com/PersonaliAI/chatty/blob/main/README.ja.md) ·\n  [Español](https://github.com/PersonaliAI/chatty/blob/main/README.es.md)\n\n### Open-source AI agent trained on your store and content.\n\nAnswers customer questions, captures leads, and books meetings on website, WhatsApp & Slack.\n\n[**🚀 Live Demo**](https://chatty.personaliai.com)  · \n  [**☁️ Chatty Cloud (Free 14-day trial)**](https://chatty.personaliai.com/signup)  · \n  [**⚡ Quickstart (5 min)**](#-quick-start-docker-compose)  · \n  **📖 Documentation**\n\nChatty is an open-source, self-hostable **Zendesk and Intercom alternative** for stores and modern businesses that need autonomous AI customer support with human takeover, WooCommerce sync, and calendar scheduling.\n\nRun the application containers on your own host while keeping Supabase Auth, Postgres, Storage, and Realtime managed. The same deployment contract works on a VPS, Railway, Render, or another Docker host without touching the live Supabase project.\n\n[Chatty Cloud (hosted)](https://chatty.personaliai.com) · [Documentation](https://docs.chatty.personaliai.com) · [Data Processing (DPA)](</PersonaliAI/chatty/blob/main/frontend/src/app/(legal)/dpa/page.tsx>) · [Sub-processors](</PersonaliAI/chatty/blob/main/frontend/src/app/(legal)/subprocessors/page.tsx>) · [Performance Scorecard](https://docs.chatty.personaliai.com/guides/scorecard) · [Flow Builder](https://docs.chatty.personaliai.com/guides/flow-architect) · [Widget Embed](https://docs.chatty.personaliai.com/guides/embed-widget) · [Secure customer identity](https://docs.chatty.personaliai.com/guides/human-takeover) · [Quick Start](#-quick-start-docker-compose) · [Platform Runbook](https://docs.chatty.personaliai.com/guides/self-hosting) · [MCP Server](#mcp-server--agent-control) · [AI Plugins](https://docs.chatty.personaliai.com/guides/ai-coding-plugins) · [Omnichannel](https://docs.chatty.personaliai.com/guides/omnichannel) · [WooCommerce](https://docs.chatty.personaliai.com/guides/woocommerce)\n\nEvery hosted chatbot SaaS charges per-seat or per-message and holds your conversation data. Chatty is open-core: run it yourself for free, or use [Chatty Cloud](https://chatty.personaliai.com) - our own hosted version of this exact repo, if you'd rather skip the ops work. Either way you get the same feature set - streaming chat, RAG over your own documents, meeting booking, lead capture, WhatsApp/Slack channels, and a full [MCP server](#mcp-server--agent-control) so an AI agent can run the whole dashboard for you.\n\n| Capability | Closed-source SaaS chatbots | **Chatty** | \n|---|---|---|\n| **Data Ownership** | Stored on third-party servers, vendor locked | **Cloud** : Hosted on Chatty Cloud with zero AI training guarantee**Self-Host** : 100% in your own private Supabase instance | \n| **Pricing** | High per-seat fees & message overages | **Self-host for $0 forever** (MIT), or predictable flat-rate hosted cloud tiers | \n| **LLM Choice** | Locked to vendor models | **Bring your own (BYOK)** : Gemini, OpenAI, Claude, OpenRouter, or local models | \n| **Agent / MCP Access** | None, or expensive enterprise add-on | **Official 81-tool FastMCP server included** (OAuth 2.0 PKCE & API Keys) | \n| **Source Code & License** | Proprietary closed source | **MIT Licensed** — 100% open-source, forkable, auditable, run anywhere | \n\nAll 22 core modules are captured from live production ([`chatty.personaliai.com/dashboard`](https://chatty.personaliai.com/dashboard)) in crisp **4K Retina (3840×2160)** resolution, representing real hydrated application state:\n\n|  **Omnichannel Live Helpdesk & SLA Inbox**<sub>Real-time visitor threads, SLA breach warnings & 1-click human takeover</sub> |  **Knowledge Base & Vector Documents**<sub>Multi-format ingestion, recursive crawler & 186k+ tokens indexed</sub> | \n|  **LiveKit WebRTC Voice Studio**<sub>Sub-500ms bidirectional audio, dynamic visualizers & multi-platform SDKs</sub> |  **Visual Conversation Flow Architect**<sub>Interactive decision tree graph with AI Flow Copilot & cycle validation</sub> | \n|  **Live Widget Customizer & Style Studio**<sub>WYSIWYG live preview with automated WCAG AA/AAA contrast engine</sub> |  **Resolution Rates & Deflection Telemetry**<sub>Conversation volume, 100% deflection rate, and token usage heatmaps</sub> | \n\n## **📸 Click to explore all 22 High-Resolution Production Dashboard Views**\n\n| # | Module | Description | High-Res Capture | \n|---|---|---|---|\n| **01** | **Executive Overview** | 5-pillar health score, deflection rate & live 30-day KPIs | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-01-overview.png) | \n| **02** | **Chatbot Workspace** | Multi-bot management, model switching (GPT-4o, Claude, Gemini) | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-02-workspace.png) | \n| **03** | **Widget Customizer** | 6-part styling palette, brand logo, WCAG contrast pass/fail | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-03-customizer.png) | \n| **04** | **Knowledge Base** | 52+ sources, 186k chars indexed, HNSW vector search | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-04-knowledge-base.png) | \n| **05** | **AI Playground** | Sandboxed simulator with citation inspect drawer | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-05-playground.png) | \n| **06** | **Omnichannel Inbox** | Unified helpdesk, live visitor presence, SLA breach timers | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-06-inbox.png) | \n| **07** | **Campaigns** | Proactive announcement modals, exit-intent & scroll triggers | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-07-campaigns.png) | \n| **08** | **Flow Builder** | Drag-and-drop conversation canvas with AI Flow Copilot | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-08-flow-builder.png) | \n| **09** | **Visitor Leads CRM** | Automated lead extraction, GeoIP country/city telemetry, CSV export | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-09-leads.png) | \n| **10** | **Feedback & CSAT** | Post-chat customer ratings, sentiment analysis & friction tags | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-10-feedback.png) | \n| **11** | **Visitor Map** | Interactive Leaflet geolocation map showing regional traffic | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-11-map.png) | \n| **12** | **Meeting Scheduler** | 2-way Google Calendar OAuth sync & automated Meet links | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-12-meetings.png) | \n| **13** | **Inbound Mailbox** | Resend email routing converting incoming emails to tickets | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-13-mailbox.png) | \n| **14** | **Team Notifications** | Incident alert policies dispatching via Slack, Email, and SMS | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-14-notifications.png) | \n| **15** | **Audit Log** | Immutable append-only audit trail logging IP and actor email | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-15-audit-log.png) | \n| **16** | **Analytics** | Deflection analytics, resolution speed, and token heatmaps | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-16-analytics.png) | \n| **17** | **Embed & Integrate** | Embed generator for React, Next.js, WordPress & domain allowlist | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-17-embed-integrate.png) | \n| **18** | **Voice Agent** | LiveKit WebRTC studio with active visualizer & multi-SDK code | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-18-voice-agent.png) | \n| **19** | **FastMCP Server Hub** | 81 tools & 8 resources for Claude Desktop, Cursor, Antigravity | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-19-mcp.png) | \n| **20** | **Developer API** | Scoped API keys ( `chatty_sk_...` ) & multi-language SDK snippets | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-20-developer-api.png) | \n| **21** | **Billing & Quota** | Stripe portal, quota ledger, and affiliate referral program | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-21-billing.png) | \n| **22** | **Agent Settings** | Strict vector grounding, PII scrubbing, and BYOK encryption | [View 4K Image](https://github.com/PersonaliAI/chatty/blob/main/screenshots/real-22-agent-settings.png) | \n\n- 🔌 **7-Channel Omnichannel Hub** — Production-grade native messaging across WhatsApp Cloud API, Facebook Messenger, Instagram Direct, TikTok Business Messaging, Telegram Bot, Twilio Two-Way SMS (with automated TCPA opt-outs), and Inbound Support Email with quote-stripping.\n- 🗺️ **Visual Flow Builder Engine** — Drag-and-drop interactive canvas (`@xyflow/react` ) featuring declarative time-of-day condition branches (e.g. before 6:00 PM vs after 6:00 PM dynamic offers), lead capture, calendar booking, API webhooks, platform metadata detection, and AI Flow Copilot.\n- ⚡ **Live Human Takeover & Inbox** — Real-time Server-Sent Events (SSE) streaming inbox enabling human agents to pause bot automation with one click and chat directly into WhatsApp, Instagram, TikTok, or SMS.\n- 🛒 **WooCommerce & Multimodal RAG** — Direct WooCommerce store sync (order status lookup, live inventory, cart links) alongside PDF, DOCX, CSV, TXT ingestion, web crawling, and multimodal image context.\n- 🎙️ **LiveKit Voice Agent** — Real-time WebRTC bidirectional voice conversations with 5 audio visualizers (`wave` ,`bar` ,`grid` ,`radial` ,`aura` ), live speech transcription, pipeline & realtime multimodal models, and native embed support across Web, React, iOS, Android, Flutter, and React Native.\n- 💬 **Embeddable Chat Widget** — One`<script>` tag, streaming SSE replies, crisp vector Shadow DOM rendering on any site with zero CSS bleed.\n- 📚 **RAG Knowledge Hub** — Deep semantic retrieval powered by PostgreSQL`pgvector` , HNSW indexing, and hybrid lexical/vector search.\n- 🛠️ **Autonomous Tool-Calling** — Schedules real meetings (Google Meet, Microsoft Teams, Zoom), qualifies leads, and checks calendars.\n- 🔑 **Bring Your Own Key (BYOK)** — Free-tier Gemini by default, or per-bot OpenAI/Anthropic/Groq with AES-128 encryption.\n- 🤖 **81-Tool FastMCP Server** — Control the entire dashboard programmatically from Claude Desktop, Cursor, or Codex via OAuth 2.0 / API Keys (including complete Voice Agent configuration, screenshot telemetry, and autonomous workflows).\n- 📊 **5-Pillar Scorecard** — Independent A–F performance auditing across Conversion, Deflection, Accuracy, Reliability, and CSAT.\n- 🎯 **Proactive Campaigns** — Behavioral triggers (exit-intent, time-on-page, scroll-depth) with timezone-aware cadence planning.\n- 🐳 **One-Command Self-Host** —`docker compose up` , point to Supabase, and launch in 60 seconds.\n\n## **🔧 Deep Dive: Campaign Telemetry & Flow Builder Safety Architecture**\n\nCampaign configuration is persisted in `chatty_campaigns`. Widget deployments record `impression`, `click`, and `conversion` events through `POST /api/widget/campaign-events` with `bot_id`, `campaign_id`, and an optional `idempotency_key` (safe for retries). Recomputed analytics are accessible via `GET /api/bots/{bot_id}/campaigns/{campaign_id}/analytics`.\n\nCampaign drafts support a validated `schedule_config` (`once`, `hourly`, `daily`, or `weekly` with IANA timezone). `POST /api/bots/{bot_id}/campaigns/audience-suggest` generates bounded segments, intent thresholds, and rationales before saving. Delivery channels include web, email, WhatsApp, and SMS. Safety policies support overnight quiet hours (`quiet_hours: {\"start\": \"22:00\", \"end\": \"08:00\"}`). The background worker `python -m app.workers.campaign_scheduler` claims Redis idempotency keys for 24 hours to prevent duplicate dispatches. Provider-backed steps are expanded only for leads with explicit marketing consent and are then filtered by the same `segment`, `returning_only`, and `min_intent_score` rules used by the widget; qualification signals may be persisted in `chatty_leads.custom_fields` by an AI flow. Provider jobs additionally claim a hashed recipient/campaign frequency-cap key atomically before sending; cap hits are recorded as intentional suppressions, not retries. Each queued provider job carries its deterministic delivery key into the worker, which upserts `queued`, `sent`, `failed`, or `suppressed` state in `chatty_campaign_deliveries`; campaign analytics reports delivery success rate and channel breakdown without exposing recipient addresses. Apply migration `20260930130000_campaign_delivery_ledger.sql` before enabling provider campaigns in a new environment. Email delivery uses configured Resend or OneSignal credentials; unconfigured channels fail closed.\n\nThe AI Flow Architect endpoint (`POST /api/flow/generate`) requires authenticated users with `settings` permission. Prompts are bounded to 4,000 characters, and generated graphs are validated for unique node IDs and resolvable edge references. Dry-runs enforce execution step budgets to prevent runaway loops and store immutable graph snapshots for deterministic replay. Webhook/action mappings use a safe `{{input}}` and `{{context.path}}` resolver; exact-value mappings preserve JSON types and unresolved fields are surfaced in the trace rather than silently sent.\n\nPublished widget flows execute their control nodes too: `delay` is capped at five minutes, `condition` accepts only the declarative `input ==`, `!=`, `contains`, `starts_with`, and `ends_with` grammar, and `loop` has a 100-iteration hard ceiling plus an explicit `done`, `complete`, or `exit` route. A `webhook` node is dispatched through `POST /api/widget/flow/webhook`, not from browser JavaScript. The API reloads the current active flow and permits only the selected published node's `config.url` (or `config.webhook_url`), posts a bounded mapped body, adds an idempotency key, disables redirects, and pins DNS through the SSRF guard. Browser-supplied destinations, headers, and methods are never accepted. A webhook can set bounded `max_attempts` (1–5), `backoff_ms` (0–5,000), and `timeout_ms` (500–30,000); only connection errors, timeouts, and 5xx responses are retried. Use labeled `success`/` true` and `error`/` failed`/` timeout` edges to make the outcome path explicit. Operators can inspect an immutable run snapshot and trace at `GET /api/bots/{bot_id}/flow/runs/{run_id}` before replaying it.\n\nChatty provides native, industrial-standard bidirectional messaging across all major customer conversation surfaces from a single, unified workspace. Messages from every platform normalize into an internal event pipeline, allowing automated flows, the AI brain, and human operators to interact seamlessly.\n\n| Channel | Protocol / Provider | Payloads & UI Controls | Webhook Auth & Verification | Session Prefix | Human Takeover | \n|---|---|---|---|---|---|\n| **WhatsApp** | Meta Cloud API | Text, Media, Templates, Interactive Buttons (Max 3), Lists | `X-Hub-Signature-256` (HMAC-SHA256) | `wa:` | ✅ Real-time | \n| **Messenger** | Meta Graph API | Text, Attachments, Quick Replies (Max 13), Postbacks | `X-Hub-Signature-256` (HMAC-SHA256) | `fb:` | ✅ Real-time | \n| **Instagram DM** | Meta Graph API | Direct Messages, Story Mentions, Quick Replies | `X-Hub-Signature-256` (HMAC-SHA256) | `ig:` | ✅ Real-time | \n| **TikTok** | TikTok Business Messaging | Text, Quick-Reply Buttons (Max 3) | Timestamped HMAC ( `t=...,s=...` ) | `tt:` | ✅ Real-time | \n| **Telegram** | Telegram Bot API | Text, Markdown, Multi-row Dynamic Inline Keyboards | `X-Telegram-Bot-Api-Secret-Token` | `tg:` | ✅ Real-time | \n| **Two-Way SMS** | Twilio Messaging | Plain Text, Automated TCPA STOP/UNSUBSCRIBE Opt-out | Twilio Cryptographic Signature | `sms:` | ✅ Real-time | \n| **Support Email** | Resend / SendGrid Inbound | Clean Body, Automatic Quoted-Reply Stripping | Webhook Secret Challenge | `email:` | ✅ Real-time | \n\n- **Zero-Latency Ingestion Queue:** Webhook endpoints perform HMAC verification and return`HTTP 200 OK` in <40ms, preventing Meta and TikTok from triggering exponential 3-second webhook retry storms while the AI reasons.\n- **Smart UI Normalization:** Interactive buttons automatically adapt across channels (rendered as native inline keyboard grids on Telegram, sliced to 3 quick-reply buttons on WhatsApp and TikTok, and transpiled into numbered text options like`Reply [1] or [2]` for SMS).\n- **24-Hour Messaging Window Enforcement:** Tracks`last_inbound_at` on Meta channels to prevent API rejection codes (`131047` ), automatically falling back to pre-approved WhatsApp Business templates when the window expires.\n- **TCPA Compliance Interceptor:** Deterministically halts automation and registers opt-outs when users text regulatory keywords (`STOP` ,`UNSUBSCRIBE` ,`CANCEL` ,`QUIT` ).\n- **Non-Destructive Secret Store:** Credentials and webhook verify tokens are stored in an encrypted PostgreSQL JSONB envelope (`omnichannel_config` ), ensuring updates to one channel never wipe keys from another.\n\nChatty includes a visual node-based conversation engine built on `@xyflow/react`. You can design rigid conversational paths for high-stakes business logic (lead qualification, appointment scheduling, promotional campaigns) and let the AI brain handle open-ended questions.\n\n- **Time-Conditional Branching:** Condition nodes support 24-hour and 12-hour time comparisons (e.g.`< 18:00` vs`>= 18:00` ). Build time-variable marketing campaigns where visitors chatting before 6:00 PM receive early-bird offers expiring at 6:30 PM, while evening visitors receive offers valid until 9:00 PM.\n- **Platform & Device Metadata:** Nodes inspect normalized incoming request metadata (`platform` ,`channel` ,`device` ,`os` ) to serve channel-specific answers or routing rules.\n- **Deterministic Flow Nodes:**  - **Trigger:** Activates on events (`session.started` ,`message.user` ,`lead.created` ).\n  - **Message & Question:** Sends rich markdown with multiple-choice buttons.\n  - **Condition:** Declarative branching based on text input, captured variables, tags, or time-of-day.\n  - **Lead Capture:** Gathers name, email, phone, and company into the CRM ledger.\n  - **Book Meeting:** Generates real Google Meet, Microsoft Teams, or Zoom appointment links.\n  - **Webhook:** Issues secure outbound HTTP requests with SSRF protection and retry policies.\n  - **AI Fallback:** Seamlessly delegates conversation turns to the RAG knowledge base.\n\nChatty connects directly to WooCommerce stores to deliver conversational e-commerce experiences:\n\n- **Real-Time Order Tracking:** Visitors can query order status, shipping updates, and delivery tracking numbers using their order ID or billing email.\n- **Live Product Search & Inventory:** Queries active catalog stock, regular and sale pricing, and product descriptions directly through WooCommerce REST APIs.\n- **Multimodal Document RAG:** Indexes PDFs, DOCX, CSV tables, plain text, and recursive website sitemaps using PostgreSQL`pgvector` with HNSW indexing and hybrid semantic search.\n- **Image Context:** Multimodal vision processing allows visitors to upload product photos or screenshots for troubleshooting and visual inquiry.\n\nChatty features an enterprise-grade, real-time voice agent powered by [LiveKit WebRTC](https://livekit.io), supporting low-latency bidirectional voice, 5 dynamic audio visualizers, live transcription cards, knowledge base grounding, calendar booking, and native multi-platform SDKs.\n\n- **Modular Pipeline Mode** :\n  - **Speech-to-Text (STT)** : Google Cloud Speech Chirp, Deepgram Nova-3, OpenAI Whisper, Cartesia, Soniox, AssemblyAI.\n  - **Reasoning (LLM)** : Gemini 2.5 Flash, Claude 3.5 Sonnet, GPT-4o-mini, OpenRouter.\n  - **Text-to-Speech (TTS)** : Google Gemini TTS, Cartesia Sonic, ElevenLabs, Deepgram Aura, OpenAI Audio, Fish Audio.\n- **Multimodal Realtime Mode** : Direct speech-to-speech multimodal audio with Gemini Live 2.5 Flash Native Audio, OpenAI Realtime, Azure OpenAI, and Ultravox.\n\nChoose from 5 reactive audio representations in the dashboard or via SDK props:\n\n- `wave` — Fluid harmonic sine waveform with natural audio peaks.\n- `bar` — Animated frequency spectrum equalizer bars.\n- `grid` — Futuristic LED matrix audio grid reacting to decibel energy.\n- `radial` — Concentric circular ripples pulsating to voice intensity.\n- `aura` — Radiant, breathing atmospheric aura with expression pitch reactivity.\n\n| Platform / SDK | Voice Agent UI Component / Embed | Programmatic Control / Tokens | \n|---|---|---|\n| **HTML Script** (`widget.js` ) | `<script src=\"...\" data-mode=\"voice\" data-display=\"modal\"></script>` | `window.Chatty.openVoice()` | \n| **React / Next.js** (`@personaliai/react-widget` ) | `<VoiceAgent botId=\"...\" />` or`<ChattyWidget mode=\"voice\" />` | `useChatty().openVoice()` | \n| **iOS** (SwiftUI) | `ChattyVoiceView(botId: \"...\")` | `ChattyClient.createVoiceToken(...)` | \n| **Android** (Compose) | `ChattyVoiceScreen(botId = \"...\")` | `ChattyApi.createVoiceToken(...)` | \n| **Flutter** | `ChattyVoiceScreen(botId: '...')` | `ChattyClient.createVoiceToken(...)` | \n| **React Native** | `<ChattyVoiceView botId=\"...\" />` | `ChattyClient.createVoiceToken(...)` | \n| **Iframe Embed** | `<iframe src=\"https://chatty.personaliai.com/embed/{botId}?voice=only\"></iframe>` | Direct hosted browser embed | \n\n- **Hardware-Accelerated WebRTC AEC** : Browser and mobile devices negotiate client-side Acoustic Echo Cancellation, noise suppression, and auto gain control.\n- **Zero Comb-Filtering Artifacts** : The LiveKit worker runtime eliminates redundant server-side AEC filters, guaranteeing clean, natural speech without metallic vibration or stuttering.\n- **Session Memory Reset** : A built-in reset action (`POST /api/widget/voice/reset` ) flushes past conversation context from the database and rotates room nonces for clean reconnects.\n\nThe public repository has one canonical application layout: `frontend/` contains the Next.js dashboard, embeddable widget, and visual flow builder canvas, while `backend/` contains the FastAPI API, omnichannel adapters, background queue workers, and database migrations.\n\n```\nflowchart TB\n    subgraph INBOUND[\"Omnichannel Ingress & Clients\"]\n        direction LR\n        WIDGET[\"Web Widget & LiveKit Voice\"]\n        WA[\"WhatsApp Cloud API\"]\n        META[\"Messenger & Instagram Direct\"]\n        TT[\"TikTok Business Messaging\"]\n        TG[\"Telegram Bot\"]\n        SMS[\"Twilio Two-Way SMS\"]\n        MAIL[\"Support Inbound Email\"]\n    end\n\n    subgraph GATEWAY[\"Security & Webhook Ingestion Gateway\"]\n        direction TB\n        HMAC[\"Cryptographic Auth (HMAC-SHA256 / Tokens)\"]\n        ACK[\"Sub-40ms HTTP 200 OK Fast ACK\"]\n        QUEUE[\"Async Deduplication & Event Pipeline\"]\n        DLP[\"Real-time PII & Sensitive Data Scrubber\"]\n    end\n\n    subgraph CORE[\"Dual-Engine Execution Brain\"]\n        direction LR\n        subgraph FLOW[\"Visual Flow Builder Runtime\"]\n            FNODES[\"Flow Nodes (@xyflow/react)\"]\n            FCOND[\"Time & Condition Routing\"]\n            FLEAD[\"Lead Capture & CRM Sync\"]\n            FBOOK[\"Calendar Meeting Dispatch\"]\n        end\n        subgraph BRAIN[\"Multimodal RAG & AI Reasoning\"]\n            VECT[\"pgvector Hybrid Semantic Search\"]\n            KB[\"Knowledge Docs (PDF/DOCX/CSV/TXT)\"]\n            WOO[\"WooCommerce Store & Orders API\"]\n            LLM[\"BYOK LLMs (Gemini / Claude / GPT / Groq)\"]\n        end\n    end\n\n    subgraph TAKEOVER[\"Live Operator Desk\"]\n        direction TB\n        SSE[\"Real-Time SSE Event Stream\"]\n        INBOX[\"Unified Helpdesk & SLA Inbox\"]\n        HUMAN[\"1-Click Human Agent Takeover\"]\n    end\n\n    subgraph OUTBOUND[\"Channel UI Normalizer & Dispatch\"]\n        direction LR\n        OUT_WA[\"WhatsApp 24h Window & Templates\"]\n        OUT_TT[\"TikTok Quick Replies (Max 3)\"]\n        OUT_TG[\"Telegram Dynamic Inline Keyboards\"]\n        OUT_SMS[\"SMS Numbered Choices & TCPA Opt-out\"]\n        OUT_MAIL[\"Email Clean Threaded Replies\"]\n        OUT_WEB[\"Widget Streamdown & Rich Cards\"]\n    end\n\n    INBOUND --> GATEWAY\n    HMAC --> ACK\n    ACK --> QUEUE\n    QUEUE --> DLP\n    DLP --> CORE\n\n    CORE <--> TAKEOVER\n    CORE --> OUTBOUND\n    TAKEOVER --> OUTBOUND\n```\n\n## **📐 View Full Architecture Diagram (Click to expand)**\n\n```\nflowchart TB\n    classDef actor fill:#f8fafc,stroke:#64748b,color:#0f172a\n    classDef edge fill:#eff6ff,stroke:#2563eb,color:#1e3a8a\n    classDef app fill:#ecfdf5,stroke:#059669,color:#064e3b\n    classDef data fill:#f0fdfa,stroke:#0f766e,color:#134e4a\n    classDef integration fill:#fff7ed,stroke:#ea580c,color:#7c2d12\n    classDef deploy fill:#f5f3ff,stroke:#7c3aed,color:#4c1d95\n\n    subgraph clients[\"Clients & Channels\"]\n        direction LR\n        visitor((\"Website Visitor\")):::actor\n        operator((\"Support Agent\")):::actor\n        omni[\"WhatsApp · Messenger · IG · TikTok · TG · SMS · Email · MCP\"]:::actor\n    end\n    subgraph edge[\"Public Edge\"]\n        direction LR\n        tls[\"TLS · Domain Allowlist · Rate Limits\"]:::edge\n        web[\"Next.js 15+ Frontend (App Router)\"]:::app\n    end\n    subgraph runtime[\"Chatty Runtime\"]\n        direction LR\n        api[\"FastAPI Backend · Flow Engine · RAG · Webhooks\"]:::app\n        mcp[\"FastMCP 81-Tool Server (OAuth 2.0 / API Keys)\"]:::app\n    end\n    subgraph managed[\"Managed Supabase Tier\"]\n        direction LR\n        auth[\"Supabase Auth\"]:::data\n        postgres[\"Postgres + pgvector · JSONB Configs · RLS\"]:::data\n        storage[\"Supabase Storage (Documents & Audio)\"]:::data\n        realtime[\"Supabase Realtime\"]:::data\n    end\n    subgraph integrations[\"External Services\"]\n        direction TB\n        llm[\"LLM Providers (Gemini / OpenAI / Anthropic / Groq)\"]:::integration\n        calendar[\"Google Calendar & Microsoft 365\"]:::integration\n        wooCommerce[\"WooCommerce Store API\"]:::integration\n        voiceLiveKit[\"LiveKit WebRTC Audio Mesh\"]:::integration\n    end\n    subgraph targets[\"Deployment Targets\"]\n        direction LR\n        docker[\"Docker Compose / VPS\"]:::deploy\n        railway[\"Railway\"]:::deploy\n        render[\"Render Blueprint\"]:::deploy\n        cloudrun[\"Google Cloud Run\"]:::deploy\n    end\n\n    visitor --> tls\n    operator --> web\n    omni --> api\n    tls --> web\n    web -->|HTTPS| api\n    api --> auth\n    api --> postgres\n    api --> storage\n    api --> realtime\n    api --> llm\n    api --> calendar\n    api --> wooCommerce\n    api --> voiceLiveKit\n    targets -. runs .-> runtime\n    linkStyle default stroke:#64748b,stroke-width:1.5px\nchatty/\n├── frontend/         Next.js - dashboard, embeddable widget, widget.js loader\n├── backend/          FastAPI - chat/RAG/bookings/channels/OAuth/MCP API\n│   ├── app/          Routers, core (auth/security/db helpers), schemas\n│   ├── plugins/       Google/Microsoft integrations, RAG, widget orchestration\n│   ├── supabase/      Database schema and migrations (applied in order)\n│   ├── scripts/       apply_migrations.py and other one-off ops scripts\n│   └── tests/          pytest smoke + unit tests\n└── docker-compose.yml\n```\n\n| Profile | Data and identity services | When to use | \n|---|---|---|\n| `managed_supabase` (default) | Supabase Auth, Postgres, Storage, pgvector, and RLS | Chatty Cloud and every supported application deployment | \n\nThe managed-Supabase deployment contract is two Docker services (API + frontend).\nThe root `docker-compose.yml` runs both services without provisioning a second\ndatabase. The complete platform runbook, including secret handling, domains,\nhealth checks, verification, rollback, and troubleshooting, is in\n[https://docs.chatty.personaliai.com/guides/self-hosting](https://docs.chatty.personaliai.com/guides/self-hosting).\n\n| Platform | Official deployment guide | Current repository status | \n|---|---|---|\n|  | [Managed-Supabase Docker Compose](https://github.com/PersonaliAI/chatty/blob/main/docker-compose.yml) | **Supported now** for the API + frontend; put TLS in front. | \n|  | [Railway Docker Compose guide](https://docs.railway.com/guides/docker-compose) | **Supported as two services** ; Railway maps the API and frontend Dockerfiles separately. | \n|  | [`render.yaml`](https://github.com/PersonaliAI/chatty/blob/main/render.yaml) /[Render Blueprint reference](https://render.com/docs/blueprint-spec) | **Blueprint included** ; it creates the API + frontend services and prompts for secrets. | \n|  | [Heroku container runtime](https://devcenter.heroku.com/articles/container-registry-and-runtime) | **Supported as two container apps** ; no full-stack Button is claimed. | \n\nFor every supported application deployment keep `DEPLOYMENT_PROFILE=managed_supabase`.\n\n|  | Version | Needed for | \n|---|---|---|\n| [Docker](https://docs.docker.com/get-docker/) + Docker Compose | 24+ | Quick Start (recommended path) | \n| [Python](https://www.python.org/downloads/) | 3.11+ | Backend, without Docker | \n| [Node.js](https://nodejs.org/) | 20+ | Frontend, without Docker | \n| [Supabase](https://supabase.com) account | free tier | Database (Postgres + Auth + Storage) | \n| [Google AI Studio](https://aistudio.google.com/apikey) API key | free tier | Default LLM (Gemini) | \n\nEverything else (WhatsApp/Slack tokens, Google/Microsoft OAuth, Lemon Squeezy billing, Sentry, Upstash Redis) is **optional** - each env var you leave blank just disables that one feature; nothing else breaks.\n\nUsage and analytics stay with the deployment: self-hosted operators keep conversation counts, weighted AI credits, tokens, latency, and provider-cost telemetry in their own Supabase project. BYOK inference is still sent directly to the selected model provider, and unpriced BYOK calls remain visible by tokens/call count even when a dollar estimate is unavailable. No Chatty Cloud account is required for the open-source deployment.\n\nDeploy Chatty directly to the cloud without managing a server:\n\nChatty uses a **managed-Supabase architecture** (containers run on Render/Railway, while Auth, Postgres, Storage, and Realtime stay managed in Supabase). Before or immediately after clicking deploy, complete these 3 quick steps:\n\n1. **Create a Free Supabase Project:** Go to[supabase.com](https://supabase.com) , create a free project, and copy your**Project URL** ,**`anon` key** ,**`service_role` key** , and**Database Connection String** from Project Settings.\n2. **Apply Database Migrations:** Run the migration script once so all 67+ tables and vector schemas are initialized:\n\n```\ncd backend && pip install psycopg2-binary\npython scripts/apply_migrations.py \"postgresql://postgres:YOUR_PASSWORD@YOUR_HOST:5432/postgres\"\n```\n\n *(Or run the SQL files in `backend/supabase/migrations/` in Supabase's SQL Editor).*\n3. **Get Free Gemini API Key & Set Variables:** Get a key from[aistudio.google.com/apikey](https://aistudio.google.com/apikey) . When Render or Railway prompts for environment variables, fill in your`SUPABASE_URL` ,`SUPABASE_SECRET_KEY` ,`GEMINI_API_KEY` ,`NEXT_PUBLIC_SUPABASE_URL` , and`NEXT_PUBLIC_SUPABASE_ANON_KEY` .\n\nThe fastest path from clone to a running instance. See [Self-Hosting, Step by Step](#-self-hosting-step-by-step) below if you want the full walkthrough with screenshots-in-words and troubleshooting.\n\n```\ngit clone --recurse-submodules https://github.com/PersonaliAI/chatty.git\ncd chatty\n\n# Optional plugin and SDK source checkouts are independent submodules.\n# For an existing clone, use: git submodule update --init --recursive\n\n# 1. Apply the database schema to a Supabase project you've already created\ncd backend && pip install psycopg2-binary\npython scripts/apply_migrations.py \"postgresql://postgres:YOUR_PASSWORD@YOUR_HOST:5432/postgres\"\ncd ..\n\n# 2. Configure environment variables\ncp backend/.env.example backend/.env        # fill in Supabase + Gemini keys\ncp frontend/.env.example frontend/.env      # fill in Supabase URL + anon key\ncp .env.example .env                        # same NEXT_PUBLIC_* values (used at Docker build time)\n\n# 3. Run it\ndocker compose up --build backend frontend\n```\n\nDashboard: `http://localhost:3000` - sign up, create a bot, and the widget embed snippet is generated for you under bot settings.\n\nA fuller walkthrough than the Quick Start above - read this if it's your first time, or if something in Quick Start didn't work.\n\n1. Go to [supabase.com](https://supabase.com) , sign up, and click**New Project** . The free tier is enough to run Chatty (upgrade later if you outgrow it).\n2. Pick a region close to where you'll deploy the backend, set a database password, and wait for provisioning (~2 minutes).\n3. Once the project is ready, go to **Project Settings → API** and note down:\n  - **Project URL** (`https://xxxxx.supabase.co` )\n  - **`anon` `public`** key\n  - **`service_role`** key (keep this one secret - it bypasses row-level security)\n4. Go to **Project Settings → Database → Connection string → URI** . Use the**Session pooler** or**direct connection** string (not the transaction pooler - schema migrations need a persistent session). You'll use this once, in the next step.\n\nChatty ships ordered SQL migration files under `backend/supabase/migrations/`. Apply them all in order with the included script - it's idempotent (tracks what's already applied in a `_migrations_log` table), so it's always safe to re-run after pulling updates:\n\n```\ncd backend\npip install psycopg2-binary\npython scripts/apply_migrations.py \"postgresql://postgres:YOUR_PASSWORD@YOUR_HOST:5432/postgres\"\n```\n\nYou should see output like:\n\n```\n<current migration count> migration files found\n  applied 20260510084430_initial_schema.sql\n  applied 20260511120000_slice2_billing_and_integrations.sql\n  ...\nDone - applied 67 new, skipped 0 already-applied.\n```\n\nIf a migration fails partway through, the script stops and prints which file failed - fix the reported issue (usually a stale connection or an already-modified table from manual tinkering) and re-run; already-applied files are skipped automatically.\n\nChatty defaults to Google's Gemini (generous free tier via Google AI Studio):\n\n1. Go to [aistudio.google.com/apikey](https://aistudio.google.com/apikey) .\n2. Sign in with a Google account and click **Create API key** .\n3. Copy the key - you'll paste it into `GEMINI_API_KEY` in the next step.\n\nPrefer a different model? Every bot supports BYOK (OpenAI, Anthropic, or OpenRouter) configurable per-bot from the dashboard once it's running - you don't need to decide this now.\n\nThree files, one per surface:\n\n```\ncp backend/.env.example backend/.env\ncp frontend/.env.example frontend/.env\ncp .env.example .env\n```\n\nOpen `backend/.env` and fill in, at minimum:\n\n```\nSUPABASE_URL=https://xxxxx.supabase.co\nSUPABASE_SECRET_KEY=<secret key from Step 1>\nSUPABASE_DB_HOST=<from the connection string in Step 1>\nSUPABASE_DB_PASSWORD=<your database password from Step 1>\n\nGEMINI_API_KEY=<from Step 3>\n\n# Generate each of these once with the command shown next to it:\nFUNCTION_SECRET=<python -c \"import secrets; print(secrets.token_urlsafe(32))\">\nBYOK_ENCRYPTION_KEY=<python -c \"from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())\">\n```\n\nOpen `frontend/.env` and `.env` (repo root) and fill in the matching `NEXT_PUBLIC_SUPABASE_URL` / `NEXT_PUBLIC_SUPABASE_ANON_KEY` (same values as above - the frontend only ever sees the public `anon` key, never `service_role`).\n\nEvery other variable in `backend/.env.example` is optional and documented inline - voice, WhatsApp, Slack, Google/Microsoft OAuth, billing, error monitoring, and more. Leave them blank to start; each one unlocks exactly one feature. See the full [Environment Variable Reference](#environment-variable-reference) below for what each does.\n\n**If you're deploying under your own domain** (not just running locally), also set `CHATTY_BACKEND_URL` and `CHATTY_FRONTEND_URL` in `backend/.env` to your real domains - these are the OAuth issuer and MCP resource identifiers; leaving them at the default breaks OAuth/MCP client discovery once you're not running on `localhost`. See [MCP Server & Agent Control](#mcp-server--agent-control).\n\n```\ndocker compose up --build backend frontend\n```\n\nFirst build takes a few minutes (installing Python/Node dependencies, compiling the Next.js production bundle). Subsequent runs are fast - Docker caches layers.\n\n- **Dashboard** :`http://localhost:3000`\n- **Backend API** :`http://localhost:8000` (interactive docs at`http://localhost:8000/docs` )\n\n1. Open `http://localhost:8000/docs` - you should see the FastAPI Swagger UI listing every endpoint. If this doesn't load, the backend container failed to start; check`docker compose logs backend` .\n2. Open `http://localhost:3000` , click**Sign up** , and create an account (this goes through Supabase Auth against your own project).\n3. Create your first bot from the dashboard. Add a knowledge source (paste some text or a URL) and try it in the Playground tab.\n4. Copy the embed snippet from the bot's settings and drop it into any HTML page - the widget should load and respond using your knowledge base.\n\nIf any of these steps fail, see [Troubleshooting](#troubleshooting) below.\n\nEach of these is opt-in - set the relevant env vars in `backend/.env` and restart (`docker compose up --build backend`):\n\n| Feature | Env vars | Notes | \n|---|---|---|\n| **WhatsApp channel** | `WHATSAPP_VERIFY_TOKEN` ,`WHATSAPP_ACCESS_TOKEN` | Meta Cloud API - see [Meta's developer docs](https://developers.facebook.com/docs/whatsapp/cloud-api) . | \n| **Slack channel** | `SLACK_SIGNING_SECRET` | From your Slack app's **Basic Information** page. | \n| **Google Calendar/Gmail booking** | `GOOGLE_CLIENT_ID` ,`GOOGLE_CLIENT_SECRET` | Create OAuth credentials at [console.cloud.google.com/apis/credentials](https://console.cloud.google.com/apis/credentials) . | \n| **Microsoft 365 booking** | `MICROSOFT_CLIENT_ID` ,`MICROSOFT_CLIENT_SECRET` | Register an app in Azure AD. Real Teams online-meeting links, not a placeholder. | \n| **Real Zoom meeting links** | `ZOOM_ACCOUNT_ID` ,`ZOOM_CLIENT_ID` ,`ZOOM_CLIENT_SECRET` | Server-to-Server OAuth app in the [Zoom Marketplace](https://marketplace.zoom.us) (`meeting:write:meeting` scope). A single backend-wide credential - no per-user connect flow. Without this, bookings fall back to a placeholder link. | \n| **Billing / paid plans** | `LEMONSQUEEZY_API_KEY` + related vars | Only relevant if you're reselling access; skip entirely for internal/free use. | \n| **Error monitoring** | `SENTRY_DSN` | Optional - leave blank and errors just go to stdout/logs. | \n\nThe supported production shape is two Docker services (API + frontend) backed\nby the same managed Supabase project. The full copy/paste runbook for each\nplatform is [Self-Hosting Guide](https://docs.chatty.personaliai.com/guides/self-hosting).\nIt covers `DEPLOYMENT_PROFILE=managed_supabase`, secret-manager setup, domains,\nhealth checks, production verification, rollback, and security boundaries.\n\nThe retired provider-neutral Postgres/Redis/object-store stack is intentionally\nnot part of this repository. Do not use old `install-self-host.ps1` instructions.\n\n```\ngit pull\ncd backend && python scripts/apply_migrations.py \"postgresql://...\"   # picks up any new migrations, skips old ones\ncd .. && docker compose up --build backend frontend\n```\n\n| Symptom | Likely cause / fix | \n|---|---|\n| `docker compose up` fails immediately on`backend` with`RuntimeError: ... environment variable is required` | `SUPABASE_URL` or`SUPABASE_SECRET_KEY` is missing from`backend/.env` - these two fail startup on purpose rather than silently falling back to nothing. | \n| Backend starts but BYOK/booking/other features error at request time | `GEMINI_API_KEY` ,`FUNCTION_SECRET` , or`BYOK_ENCRYPTION_KEY` is blank - these don't crash startup, but the specific feature that needs them fails when you actually use it. Fill them in per[Step 4](#step-4--configure-environment-variables) . | \n| Migration script hangs or times out | You're using the transaction pooler connection string. Switch to the **Session pooler** or**direct connection** string from Supabase's Connection string page. | \n| Dashboard loads but sign-up fails | `NEXT_PUBLIC_SUPABASE_URL` /`NEXT_PUBLIC_SUPABASE_ANON_KEY` in`frontend/.env` don't match the project you ran migrations against. | \n| Widget embeds but never replies | Check `docker compose logs backend` for a Gemini API error - usually an invalid/missing`GEMINI_API_KEY` , or the free tier's rate limit. | \n| MCP/OAuth client can't discover the server once deployed | `CHATTY_BACKEND_URL` is still the default (`https://api.chatty.personaliai.com` ) instead of your own domain - set it explicitly once you're not on`localhost` . | \n\nStill stuck? [Open an issue](https://github.com/PersonaliAI/chatty/issues) with your `docker compose logs` output (redact secrets first).\n\n**Backend:**\n\n```\ncd backend\npython -m venv .venv && .venv\\Scripts\\activate   # or source .venv/bin/activate on macOS/Linux\npip install -r requirements.txt\nuvicorn main:app --reload --port 8000\n```\n\n**Frontend:**\n\n```\ncd frontend\nnpm install\nnpm run dev\n```\n\nChatty ships a full [Model Context Protocol](https://modelcontextprotocol.io) server - connect Claude, ChatGPT, or any MCP-compatible client and run the entire dashboard from a conversation instead of clicking through screens.\n\n- **Auth** : OAuth 2.0 authorization-code flow with mandatory PKCE (RFC 7636), dynamic client registration (RFC 7591), and authorization server metadata discovery (RFC 8414) - no API key to paste into a config file.\n- **Scopes** :`read` ,`write` ,`knowledge` ,`actions` ,`admin` - a client only gets what it's granted.\n- **81 tools** across 13 categories: bot lifecycle, customizer & design, visual flow builder, proactive campaigns, knowledge base & RAG, help center CMS, inbox & human takeover, leads/calendar/meetings, deflection analytics, WooCommerce store catalog sync, omnichannel escalations (Slack & WhatsApp), settings/guardrails/BYOK/team RBAC, and LiveKit Voice Studio & Screenshots.\n- **Live resources & prompts** : inspect live voice state via`chatty://bots/{bot_id}/voice-config` , live dashboard screenshots via`chatty://dashboard/screenshots` , and run guided workflows with`setup-voice-agent` ,`audit-and-optimize-bot` , and`build-bot-from-brand` .\n- **Real data only** - every tool reads and writes the exact same tables the dashboard does; nothing simulated.\n\nConnect by pointing an MCP client at:\n\n```\n{\n  \"mcpServers\": {\n    \"chatty\": {\n      \"url\": \"https://your-backend-domain/mcp\"\n    }\n  }\n}\n```\n\nThe client opens a normal OAuth consent screen on first connect. **If you're self-hosting under your own domain**, set `CHATTY_BACKEND_URL` (and `CHATTY_FRONTEND_URL`, for the consent screen redirect) in `backend/.env` to your real URLs first - see [Step 4](#step-4--configure-environment-variables).\n\nFor setup instructions and plugin manifests for **Claude Code** (`/plugin marketplace add PersonaliAI/chatty`), **Cursor IDE** (`.cursor/rules/`), **Claude Desktop**, and **Windsurf**, see the full [AI Coding Tools & Plugin Marketplace Guide](https://docs.chatty.personaliai.com/guides/ai-coding-plugins).\n\nEvery environment variable is documented inline in [`backend/.env.example`](https://github.com/PersonaliAI/chatty/blob/main/backend/.env.example) and [` frontend/.env.example`](https://github.com/PersonaliAI/chatty/blob/main/frontend/.env.example) - what it's for, where to get it, and what happens if you leave it blank. The tables below are the short version.\n\n**Backend - required to start:**\n\n| Variable | Purpose | \n|---|---|\n| `SUPABASE_URL` ,`SUPABASE_SECRET_KEY` | Database + auth connection; the secret key stays server-side | \n| `SUPABASE_DB_HOST` ,`SUPABASE_DB_PASSWORD` | Direct Postgres connection for a few operations PostgREST can't do | \n| `FUNCTION_SECRET` | Signs widget origin tokens + OAuth state JWTs; gates internal cron/admin endpoints | \n| `BYOK_ENCRYPTION_KEY` | Encrypts customer-supplied BYOK API keys at rest | \n| `GEMINI_API_KEY` | Default LLM | \n\n**Backend - optional, one per feature:** WhatsApp, Slack, Google/Microsoft OAuth (calendar booking), Zoom (Server-to-Server OAuth), transactional email (OneSignal), web crawl (Jina), billing (Lemon Squeezy), rate limiting (Upstash Redis), error monitoring (Sentry), and `CHATTY_BACKEND_URL`/` CHATTY_FRONTEND_URL` (only needed once you're deployed under your own domain - see [MCP Server & Agent Control](#mcp-server--agent-control)). Full list with setup links: [`backend/.env.example`](https://github.com/PersonaliAI/chatty/blob/main/backend/.env.example).\n\n**Frontend - required:**\n\n| Variable | Purpose | \n|---|---|\n| `NEXT_PUBLIC_SUPABASE_URL` ,`NEXT_PUBLIC_SUPABASE_ANON_KEY` | Must match the backend's Supabase project | \n| `NEXT_PUBLIC_BACKEND_URL` | Where the frontend calls the API - `http://localhost:8000` locally, your real backend URL in production | \n\n**Frontend - optional:** billing portal (Lemon Squeezy), Firebase Analytics. Full list: [`frontend/.env.example`](https://github.com/PersonaliAI/chatty/blob/main/frontend/.env.example).\n\n`.github/workflows/ci.yml` runs on every push/PR to `main`:\n\n- **Backend** : compile-check (`python -m compileall` ), the full pytest suite (`backend/tests/` ), and a non-blocking`pip-audit` dependency scan.\n- **Frontend** : TypeScript typecheck, ESLint, a widget design-token drift check, and a production build.\n\nRun the backend suite locally:\n\n```\ncd backend\npip install -r requirements.txt pytest\npython -m pytest tests/ -q\n```\n\n`.github/dependabot.yml` watches pip/npm/Docker/GitHub Actions dependencies weekly.\n\nChatty is built for enterprise-grade compliance with the **EU General Data Protection Regulation (Regulation (EU) 2016/679)** and the **ePrivacy Directive (Directive 2002/58/EC)**:\n\n- **Automated Data Loss Prevention (DLP):** Real-time PII scrubber (`backend/app/services/pii_service.py` ) automatically detects and redacts Luhn-verified credit card numbers, US Social Security numbers, exposed API/Bearer tokens, and ISO 7064 MOD 97-10 European IBAN bank accounts across the web widget and all omnichannel streams (WhatsApp, Instagram, Telegram, SMS, Email).\n- **Right to Erasure (RTBF / Art. 17):**  - **Cascading Contact Erasure:** Administrative endpoint`DELETE /api/admin/inbox/contacts/{id}` executes PostgreSQL stored procedure`chatty_erase_contact()` , wiping conversation history, leads, sessions, and contact records.\n  - **Self-Service Visitor Erasure:** Website visitors can independently erase their own session data and local storage directly within the live chat widget via the trash action.\n  - **Cascade Delete on Bot Removal:** Deleting a bot (`DELETE /api/bots/{id}` ) automatically cascades deletion across all 15+ child tables in PostgreSQL.\n- **Storage Limitation & Automated Retention (Art. 5(1)(e)):** Automated 90-day retention cutoff for unadopted anonymous conversations via`cron.py` , with per-bot configurable retention periods and an authenticated on-demand purge API (`POST /api/bots/{id}/retention/purge` ).\n- **Cryptographic Isolation & Multi-Tenant RLS (Art. 32):**  - **Encryption at Rest:** Sensitive BYOK API keys, OAuth tokens, and visitor identity signing keys are encrypted at rest with Fernet (authenticated AES-128-CBC + HMAC-SHA256).\n  - **Encryption in Transit:** Mandatory TLS 1.3 encryption across all APIs and webhooks.\n  - **Database Tenant Isolation:** Supabase Row-Level Security (RLS) policies isolate workspace data strictly by user ID and verified team membership.\n  - **Webhook Authentication:** Cryptographic HMAC signature verification across all omnichannel providers (Meta Graph API, Twilio, Telegram).\n- **Zero AI Foundation Model Training Guarantee:** Customer conversation turns and uploaded training documents are processed strictly in transient memory for real-time inference and are**never** used to train public foundation models (Google Vertex AI / OpenAI enterprise terms).\n- **Binding Legal Agreements:**  - Published [Data Processing Addendum (DPA)](</PersonaliAI/chatty/blob/main/frontend/src/app/(legal)/dpa/page.tsx>) incorporating European Commission Standard Contractual Clauses (SCCs).\n  - Public [Sub-processor Registry](</PersonaliAI/chatty/blob/main/frontend/src/app/(legal)/subprocessors/page.tsx>) with international transfer safeguards and SOC 2 / ISO 27001 certifications.\n- Published \n\nFound a security issue? Please **don't** open a public GitHub issue for it. Instead, use GitHub's private reporting: this repo's **Security** tab → **Report a vulnerability**. We'll respond as quickly as we can.\n\n`SUPABASE_SECRET_KEY`, `FUNCTION_SECRET`, `BYOK_ENCRYPTION_KEY`, and every OAuth/API client secret should be treated as production credentials - never commit a filled-in `.env` file (all three `.env.example` templates are already gitignored under their real names).\n\nIssues and PRs welcome - this is a young project and there are rough edges. See [CONTRIBUTING.md](https://github.com/PersonaliAI/chatty/blob/main/CONTRIBUTING.md) for the development setup and good first areas: additional STT/TTS provider plugins, additional channel integrations, deployment guides for platforms beyond Docker Compose, and docs.\n\nMIT - see [LICENSE](https://github.com/PersonaliAI/chatty/blob/main/LICENSE). Use it, fork it, ship it commercially - attribution appreciated but not required.\n\nIf Chatty is useful to you, **star the repo** ⭐ - it helps other people find it.", "url": "https://wpnews.pro/news/show-hn-chatty-open-source-ai-support-engine-with-woocommerce-sync", "canonical_source": "https://github.com/PersonaliAI/chatty", "published_at": "2026-11-10 11:57:55+00:00", "updated_at": "2026-11-10 12:25:06.708336+00:00", "lang": "en", "topics": ["ai-agents", "ai-products", "ai-tools", "agent-protocols", "artificial-intelligence"], "entities": ["PersonaliAI", "Chatty", "Chatty Cloud", "WooCommerce", "Supabase", "FastMCP", "Zendesk", "Intercom"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-chatty-open-source-ai-support-engine-with-woocommerce-sync", "markdown": "https://wpnews.pro/news/show-hn-chatty-open-source-ai-support-engine-with-woocommerce-sync.md", "text": "https://wpnews.pro/news/show-hn-chatty-open-source-ai-support-engine-with-woocommerce-sync.txt", "jsonld": "https://wpnews.pro/news/show-hn-chatty-open-source-ai-support-engine-with-woocommerce-sync.jsonld"}}