Feed it paper.
It talks back.
Point it at your website or upload your documents, and ChitChat turns them into a chatbot for your site. It answers your customers in their own words, and shows the page each answer came from.
When you are ready, connect your own systems — and it can check an order or make a booking, right inside the chat.
Free for now: no platform fee, you pay only your AI provider.
From flat sheet to chatterbox
Three folds and your documents start answering for themselves.
Start with a flat sheet
Hand over the paper: your website, PDFs, Office files, images, Confluence. Try it free with no key, then add your own OpenAI, Anthropic, Google, or OpenAI-compatible API key — encrypted at rest, and we never add a markup.
We put in the creases
ChitChat reads structure — headings, tables, diagrams, even scans — and folds it into a bot with hybrid retrieval, reranking, and a confidence gate you can measure.
It talks back — everywhere
Embed the 9 KB widget with one script tag, share a hosted chat page, or call the REST API. Every answer cites the page it came from.
And the everyday things, done properly
A retrieval pipeline you can toggle, measure and trust — with the operational basics a real product needs.
Bring your own keys
OpenAI, Anthropic, Google or any OpenAI-compatible endpoint — including self-hosted. You pay your provider directly, no per-message markup, and keys are AES-256-GCM encrypted.
Whatever you already have
PDF, Word, PowerPoint, Excel, CSV, images, text, Markdown, HTML. Vision-grade ingestion reads scanned pages, pricing tables, diagrams and screenshots, not just the text layer.
Your website, in one link
Paste your help centre and ChitChat reads the pages under it — following your sitemap and your own links, obeying robots.txt, keeping the article and throwing away the nav. Confluence spaces connect the same way.
Never out of date
Every link you add is re-checked daily, on its own: new pages appear, edited pages are re-read, deleted pages drop out. Unchanged pages cost nothing — so staying current does not spend your API budget.
Answers you can verify
Every claim is cited to the passage it came from — tap a chip and the exact quote opens in the chat. A second check then re-reads the answer against its sources, and only a fully supported one earns its "✓ Verified" badge. Thin matches still get a warm "I do not have that one" instead of a confident guess.
Owner analytics
Token spend per day, latency, answered-vs-unanswered — and a report of the questions your docs don't cover, with hellos and thank-yous counted separately so they never look like gaps.
Your bill stays bounded
Every visitor is rate-limited automatically. You set the daily message cap per bot, and the domain allowlist means nobody can run your bot — or your AI spend — from a site that is not yours.
Then go further than your documents
Your documents can answer "what is your return policy?" They cannot answer "where is my order?" — that answer lives in your order system, and it changes every day. So the bot can go and look.
From your documents — and it shows you the page
Manuals, policies, spreadsheets, slide decks, scanned PDFs, your Confluence space, your own web pages. Every answer cites where it came from, so anyone can check it. It is warm about the ordinary things — a hello gets a hello, and a question it cannot cover gets a kind answer rather than a flat one — but it will not answer the capital of France or write you a Python script. A bot that answers anything is not your bot.
From the systems that actually know
No document knows whether an order shipped this morning. Connect your order system, inventory or internal API as an MCP server, and the bot checks it while it answers. The visitor sees a timestamped receipt of exactly what it looked at.
And it can do things — but it always asks first
Cancel an order, book a slot, update a record. A tool that changes data can never run on its own. The bot states exactly what it is about to do and to which record, and nothing happens until the person chatting presses Confirm. You decide which tools change data — not the connected system.
Nothing is sent to your system until Confirm is pressed.
Answers about their account, not just an account
"Where is my order?" is the question every support bot gets wrong. Once your site can say who is signed in, personal tools answer for that person and nobody else. And when nobody is signed in, those tools simply cannot run: the call is stopped on our servers before anything reaches your system, and the bot asks them to sign in — never for an order number, which anyone could type.
Their own login, in a new tab. No order numbers, no "please confirm your email".
How does it know who is chatting?
Three ways in, and you take whichever one your setup already supports. None of them asks your customer to prove who they are by typing a reference number.
You already use a login provider
Auth0 · Keycloak · Okta · Clerk · Firebase · Cognito · Entra · Google
- You do
- Paste your issuer URL and audience. That is the whole setup.
- They see
- Nothing. They are already signed in on your site — the bot just knows.
You have your own backend
Rails · Django · Node · Laravel · anything that can sign a JWT
- You do
- Sign a short-lived token for the logged-in visitor with a key pair. You keep the private half — we hold only the public one, so we could never fake a visitor.
- They see
- Nothing. Same as above: they are signed in on your site already.
The chat is not on a page you control
Share links · Shopify · Webflow · static sites · a hosted bot
- You do
- Point us at your login. Your system then receives the visitor's own access token — so it needs no ChitChat-specific code to check it.
- They see
- A Sign in button in the chat. Their own login, in a new tab — then the bot answers the question they already asked.
Nothing happens behind your back
A bot that can cancel an order is only a good idea if you know exactly what it may do, what it did, and what it can never do on its own.
A change waits for a human
Anything that changes data stops and shows the person chatting what it is about to do, and to which record. It runs once, when they press Confirm — and never if they do not.
You say what each tool does
Some systems claim a tool is "read-only" when it is not, and that is a claim nobody can verify from outside. So your answer is the one we obey, and anything you have not marked read-only is treated as a change.
Credentials encrypted at rest
Provider keys, connection tokens, OAuth tokens and signing secrets are AES-256-GCM encrypted in the database. None is ever sent to a browser, returned by an API, or written to a log.
Every lookup and action is logged
What was checked, which system, when, how long it took, what came back, who confirmed it. Your visitors see a receipt in the chat; you see the full trail with per-tool analytics.
A stranger is never offered a personal tool
When nobody is signed in, tools marked personal are not described to the model at all. So it cannot promise them, be talked into them, or ask for an order number instead.
Prove it, on your own bot
Two evaluations you can run at any time. One scores whether the search finds the right passage. The other writes realistic customer requests for your own tools, then checks that the bot called the right one, stopped before changing anything, and admitted an outage instead of inventing an answer.
Don't take our word for it — ask ChitChat
The chat bubble in the corner of this page is the real 9 KB widget, running a bot fed with ChitChat's own documentation. Ask it how ingestion works, what the widget costs your page, or whether your keys are safe — and check its citations.
Start with your documents. Add the rest when you want it.
Create a bot, point it at your website or upload a manual, and ask it something — a few minutes, and no API key needed to try. Connecting your live systems comes later, only if you need it.
Get started free