Not a generic chatbot, not "a language model with Wikipedia knowledge". The assistant is scoped to XICTRAQ tools — it reads only your own monitoring data and runs wizards inside the app. Off-topic questions are politely declined with a handoff option. No open web access, no code generation outside the wizards.
What it actually does — and one thing it doesn't
Status, uptime, performance, SSL expiry, top pages, heatmaps, A/B tests — it hits the right endpoints and replies in 3-5 lines with real numbers from your instance.
CSP build, privacy scan, add heartbeat, plan upgrade, add-on checkout — all writing actions go through confirm cards. Nothing happens without your click.
"Take me to heatmaps for shop.example.com" — it switches client-side to the right URL incl. tab and filters. No reload wait, no manual hunting.
What it doesn't do: guess
When asked about your DNS provider, it only names a concrete vendor (Hetzner, IONOS, Strato, …) when actual tool data — nameservers, WHOIS registrar — confirms it. Otherwise it writes "in your DNS settings" generically and ships the nameservers along. Hard anti-hallucination rule baked into the system prompt — no fabricated providers, no phantom UI paths, no invented statistics.
Sounds obvious but isn't: standard LLMs love to fill gaps with plausible-sounding guesses. In a monitoring context, that's dangerous — a fabricated SSL expiry or a hallucinated alert can trigger an unnecessary domain renewal or a false alarm to stakeholders.
Architecture — how the assistant works under the hood
Behind the chat bubble sits a classic tool-use pattern: the LLM gets a system prompt with role, rules and a list of tools (JSON schemas). On each message, the model decides whether to call a tool (e.g. get_uptime or start_csp_wizard) or answer directly. Tool calls go server-side to our Laravel API and use exactly the same endpoints as the dashboard — same plan gates, same auth checks, same rate limits.
list_websites, get_uptime, get_ssl_status, get_security_score, get_alerts, list_heatmaps, list_recordings, list_experiments, get_insights, get_form_funnel, get_web_vitals, get_blacklist_status, get_dns, get_traffic. 30+ tools — read-only, no write rights.
start_csp_wizard, add_heartbeat, schedule_report, upgrade_plan, book_booster, open_alert, navigate_to. Each returns a confirm card — execution only happens after the click. No hidden mutations.
Plan gating, permissions, rate limits — all from the regular dashboard
The tool backend isn't a second, parallel API — it is the same endpoints the dashboard uses. The assistant runs as the logged-in user; a free-plan account sees through the assistant exactly what it sees in the dashboard. Try to read an Agency-tier feature and the tool returns 403 — the assistant translates that into a friendly note plus an upgrade path.
Sounds dry but matters: when we move a feature to a different plan tomorrow, the assistant doesn't need to be touched. The single source of truth is the plan matrix in the API. That avoids the typical drift bugs where an AI layer suddenly shows data the user can't see in the UI.
Three real-world dialogs
1. Morning status before coffee
You: How are things today?
Assistant:
business · 5 sites · all online · 2 alerts (1 critical) · 1× SSL soon
Critical: shop.example.com — 503 since 04:12, 142 affected
pageviews. 30-day uptime dropped to 99.81 %.
Recommended: open the alert, check escalation.
[Open alert for shop.example.com]
[Check heartbeat status]Three tool calls in the background: list_websites, get_alerts, get_uptime. Real-world response time is under two seconds because the tools fire in parallel. The follow-up buttons are not LLM hallucinations — they come from a hard-wired list the assistant derives from the tools used in the answer.
2. Debug a conversion drop
You: Why are checkouts dropping since yesterday?
Assistant:
Analysis over 7d (data since 2026-01-04, 116d history):
- Form funnel /checkout: drop at "ZIP" 38 % → 67 % since 26 Apr.
- Web Vitals: LCP /checkout 1.8s → 4.2s, same day.
- Visual changelog: new JS block in /checkout 26 Apr 14:11.
Likely cause: the new script blocks render of the ZIP validation.
Heatmap shows 12× rage-click on the submit button.
[Show heatmap /checkout]
[How do I revert the last deploy?]This is where the strength over a classic dashboard becomes obvious: form funnels, web vitals and visual changelog live in three different tabs. The assistant correlates them automatically and prioritises the most likely cause. We don't run the revert ourselves (we don't touch customer codebases), but the second follow-up pill opens the right docs section for a manual rollback.
3. Harden CSP — fully orchestrated by the assistant
You: Build a CSP for shop.example.com
Assistant:
Scanning … 17 external hosts, 3 inline <script> blocks.
First-party proxy detected — CSP built without xictraq.com hosts.
Recommendation: Report-Only mode for 7-14 days, hash-based inline
mode, no tracker whitelist needed (the proxy covers it).
[Apply CSP →]The CSP build is a real writing action: the [Apply CSP →] card opens the regular wizard with pre-filled values. Without the click, nothing happens — that's a deliberate friction point because a wrong CSP can take a live site down.
What it covers in power-user workflows
- Daily status check: "What's open, what's critical?" — single line, everything in there. Cuts the typical morning sweep from five minutes to fifteen seconds.
- Urgent troubleshooting under pressure: conversion drop, 503s, SSL trouble — the assistant correlates sources that would otherwise need five tabs. Particularly valuable on call.
- Onboarding setup: "Where do I add Slack?" / "Add a heartbeat" — it navigates and pre-fills forms via confirm cards. Cuts setup time for new team members noticeably.
- Trigger wizards: "Build a CSP for my site" — live scan plus build run entirely in chat.
- Numbers check before reports: "Top 10 pageviews of the last 30 days" — instantly copy-paste plain text for status meetings.
- Recording search: "Show me all recordings with rage-clicks on /checkout" — the assistant filters the recordings list with proper jump markers.
What it's not good for
- Strategic consulting: "Which plan fits me?" is fine, but deep sales conversations → human (with confirm dialog before handoff, no surprises).
- External research: it knows XICTRAQ topics + your own data. General web knowledge is not its job.
- Generic code generation: not a universal code generator. When a wizard solves it (e.g. CSP builder), it uses the wizard. Otherwise it declines and points at the docs.
- Predictions / "When will my site go down?": we don't ship an oracle tool. The assistant gives plain facts plus trend indicators — the call stays with the user.
Cookieless, EU-hosted, no model training on your data
An established LLM API with vendor DPA, EU SCCs and a contractually excluded training-on-your-data clause — fully listed in the DPA.
API calls go through the vendor's EU region. Persisted conversations live in our MariaDB in Hetzner DE/FI. No US data transfer.
Each user has an isolated conversation store. Tool calls only access data the logged-in user is allowed to see by their plan gate anyway.
Data-processing agreement covering the LLM subprocessor — current as of April 2026, downloadable from your account at any time.
Data flow in one sentence
Your question and the API tool replies go to Anthropic once, the LLM answer comes back, the history is persisted in our own DB. Anthropic stores the content for 30 days for abuse detection — and does not use it for training. More in the privacy policy and the DPA (account → settings → legal).
No RAG over external knowledge bases, no on-device models, no vector search across user content. Fewer subsystems, smaller attack surface. We bet on a high-quality model with crisp tool definitions instead of a chain of mediocre LLMs.
What does it cost?
Free on every plan — including Free. Limits scale with the plan but are deliberately generous enough that you never hit a paywall while debugging an actual problem:
| Plan | per conversation | per day | per month |
|---|---|---|---|
| Free €0 | 5 msgs | 15 | 50 |
| Starter €12 | 15 | 50 | 300 |
| Business €29 | 50 | 100 | 800 |
| Agency €79 | 100 | 300 | 2,000 |
Need more? AI Booster add-on at €12 per pack and month (stackable up to 3×). Each pack adds +200 messages/day and +500/month — so up to +600/day and +1,500/month extra. Works on any plan including Free.
The assistant tells you politely that the daily/monthly cap is reached and offers two options: book the AI Booster, or hand over to a human staff member (with a confirm dialog — no surprise handoffs). Reset is tomorrow morning or the 1st of next month.
Why on every plan?
The assistant is part of the product, not an upsell lever. Status checks, debug routines and adding heartbeats are everyday tasks every user runs — Free included. Limits are sized so typical workflows fit comfortably; users who push the co-pilot hard book the AI Booster or upgrade.
Security, logging, compliance
User input is never interpreted as system prompt. Tool outputs are sanitised before LLM hand-off — even if a recording event contains script-like text, it cannot reconfigure the assistant.
Every tool call runs in the logged-in user's context — a session hijack would be required to access data. Sanctum token applies, no long-lived API key in the conversation.
Every writing action (apply CSP, plan upgrade, add heartbeat) shows up in the regular audit log with source "Assistant". You see precisely what the assistant did in your account — if anything.
Anthropic is listed as a subprocessor in the DPA. Your end customer sees this transparently in the privacy policy; consent is not required because the processing is contract performance.
What happens on a model-vendor outage
If the LLM API is down, only the assistant is down — the app, the monitoring and the alerts run unchanged. A banner shows "Assistant temporarily unavailable". We deliberately did not build an automatic fallback to another model: a fallback model would meet a different tool schema without re-checking capabilities and in the worst case pull in a different data-processing chain. Better honestly "off" than secretly "different".
Roadmap — what's next
- Snippet templates: saved prompt fragments for recurring workflows ("build weekly report", "reset Stripe booster")
- Multi-site comparisons: "Which of my sites has the highest LCP increase since last month?" with auto-sorting
- Write mode for Agency plan: spinning up entire tenants with white-label branding via a single confirm card
- Embedded insights: insight results as a contextual header above each conversation, so the assistant picks the right tool from the start
What is not coming: hands-off autonomy. The assistant stays a co-pilot, not an auto-pilot. Writing actions without an explicit click are a deliberate "never".
Where to find it
On every app page — chat bubble bottom-left. Also on the public marketing site, where it answers pre-sales questions (in limited scope — no tool calls without login).
Detailed docs: /en/docs/assistant — including the full tool list and example scripts for your own workflows.