Skip to main content
Every bot has a deployment mode that decides where its chat runtime lives. The dashboard, knowledge base, conversations, and leads always live on the managed platform; the only thing that moves is where the chat itself runs and where your LLM key lives.

​
At a glance

​
How your LLM key is handled

In managed mode your LLM API key is envelope-encrypted at rest: a per-bot Data Encryption Key (AES-256-GCM) wraps the key itself, and a Key Encryption Key (KEK) held outside the database wraps the DEK. On each chat request the server unwraps the DEK, decrypts the key in memory, calls the provider, and discards the plaintext - a database-only leak reveals nothing usable. See BYO-key flow for the full detail. In self-hosted mode the chat runs in your own probot-bot runtime, so your LLM key lives in your runtime’s environment and never touches pro-bot.dev at all.

​
When to self-host the bot

Choose a self-hosted bot when you want the chat served from your own domain, want zero trust in any operator for the chat path, or want a tiny, auditable runtime you control. Everything you need is in Self-hosting your bot.

​
When managed is enough

For most job seekers the managed mode is the fastest path: there’s nothing to deploy, the key stays envelope-encrypted on pro-bot.dev, and you can export or delete everything at any time.