# Security and privacy (/docs/security-and-privacy)

Skavelo runs inside your product and, if you allow it, reads your app with a test account. These guides explain exactly what that involves.

<Cards>
  <Card title="What the widget sends" href="/docs/security-and-privacy/what-the-widget-sends" description="The data the widget collects from a page, and what it never sends." />
  <Card title="How learning stays safe" href="/docs/security-and-privacy/how-learning-stays-safe" description="What Skavelo does, and doesn't do, when it reads your sites and app." />
</Cards>

## Safeguards at a glance [#safeguards-at-a-glance]

| Area | Safeguard |
| --- | --- |
| **The widget** | Runs in an isolated layer, only on your [allowed sites](/docs/installing/allowed-sites), and never sends what users type into fields |
| **Identities** | Names and emails are shown to your team but never sent to the AI model. [Identity verification](/docs/installing/identity-verification) stops users posing as someone else. |
| **Learning** | Opens pages, menus, tabs and dialogs but blocks every request that would change data, and never clicks actions like save, send or delete. Test account passwords are encrypted. |
| **Skills** | Off by default, approved by the user every time, and run with the user's own permissions. See [How skills stay safe](/docs/skills/how-skills-stay-safe). |
| **Your workspace** | Only your team can change settings. Nothing a visitor types, and nothing Skavelo reads, can turn on skills or change how an agent behaves. |

Questions about security? Email [hello@skavelo.com](mailto:hello@skavelo.com).