# Custom AI chatbot development — built from code, with nothing to give away

URL: https://rootcr.com/ai-chatbot-development/
Updated: 2026-09-24

# Custom AI chatbot development: your own assistant for your website

> **In short:** RootCR builds AI assistants for websites and web stores as custom programming, with no chatbot platform and no template. The assistant answers from the company's live data and the full content of its website, in Hungarian and English. The language model has no access to the database, hostile text is filtered out before it reaches the model, and every conversation is logged. It runs live on bucipek.hu: the median of 80 real visitor questions was 2.1 seconds (measured 22–24 September 2026).

## What is custom-programmed?

A RootCR assistant is custom programming in every line, written for the specific business. There is no chatbot platform, rented widget, template or drag-and-drop bot builder behind it. Our own code:

- the decision whether code, the language model or a colleague answers a question;
- the search engine written for Hungarian that searches the website's content;
- the database connection and the business rules (opening hours, holidays, allergens, orders);
- the whole defence layer: filter, permissions, output check, blocking;
- the log, the notifications and the automated tests;
- the interface in the website's own look (an animated baker on bucipek.hu).

The only external services it calls are language models: to write the wording and to classify ambiguous questions. Which ones is decided at the start of the project according to your data protection requirements, and if needed, the model can be swapped at a single, isolated point, without touching the rest of the system.

## What can your own AI assistant do that an off-the-shelf chatbot cannot?

Your own assistant works from the same sources as your business: the database and the website, not an uploaded text that goes stale. The **Buci AI**, built by RootCR for bucipek.hu, reads the opening hours of 18 shops (holiday closures included) and the prices, allergens and nutrition data of the 143 products on sale straight from the database, and re-reads all 211 pages of the website every night (the service's start-up log, 2026-09-24). What goes on the website today, the assistant knows tomorrow, with no request and no code change.

Off-the-shelf services usually cannot do this. According to Smartsupp's own price list, its Mira AI agent reads **at most 20 pages** of a website (smartsupp.com, 2026-09-21); for a bakery with 18 shops and more than a hundred products that is too little from day one. And opening hours or stock kept in your own database are invisible to an off-the-shelf tool, apart from whatever you upload to it by hand.

Try it live: [bucipek.hu](https://bucipek.hu/), bottom right corner. Ask when a shop opens tomorrow, whether a pastry contains walnuts, or just ask in English.

## How does it make sure it does not make things up?

For every question, a RootCR assistant first decides who should answer, and the language model is only one of three possible responders:

1. **Code**, when the answer is data: opening hours, address, price, product category. It is assembled from templates and the database, and code does the date arithmetic too. There is nothing to invent.
2. **The language model**, when the answer is prose: how ordering works, what a guide article says, how to store a product. The model only writes from facts handed to it by code and from the relevant pages of the website, and it gives the address of the page it worked from.
3. **A colleague**, when the website does not cover the question, or when a complaint comes in. Complaints always go to a person, at the email address for that topic.

The most sensitive area is allergens. The Buci AI tells you what is on the data sheet of a specific product, but it never claims that anything is "gluten-free": missing data and a negative finding are two different things, and for someone with coeliac disease the difference has health consequences. The rule lives in code, and the model cannot override it.

## How does it defend against prompt injection?

Language models can be talked into things, and you cannot build a defence on hoping they will not be. So in a RootCR assistant hostile text should not reach the model at all, and if it does, the model has nothing to access. The layers, in order:

| Layer | What it does | What it stops |
|---|---|---|
| Normalisation | removes invisible characters and maps look-alike (for example Cyrillic) and full-width letters back | slipping past the filter with hidden characters or "іgnore"-style disguise |
| Local pattern filter | runs BEFORE the language model, with no external call, in milliseconds | "forget your instructions", "show me your system prompt", role switching, program code (in Hungarian, English and German) |
| Second opinion | for ambiguous wording ("your rules", "from now on") a separate classifier model decides | a customer gets a normal answer; a suspicious request gets one polite sentence |
| Fixed permissions | what the assistant may read is fixed per question type | "you are an admin now" persuasion: permissions live in code and cannot be widened by text |
| Output check | searches the reply for internal data before it is sent | leaking a key, an internal network address, database credentials or a script: such a reply is never sent |
| Server-side memory | the conversation history is kept by the server, not sent by the browser | smuggling in a fake "earlier answer" |

## How does it rule out SQL injection and XSS?

**SQL injection.** In a RootCR assistant the language model never writes a database query. Queries are fixed and parameterised, and the program runs under a separate database user with read-only rights on the public tables only: products, shops, stock. To that user, the customer accounts and orders tables do not even exist. SQL injection is not caught by a filter here: there is nowhere to inject.

**XSS (cross-site scripting).** The reply reaches the page as plain text: the server HTML-encodes every output, and links are turned into safe elements by the interface itself. The model cannot get a script or HTML onto the page. On top of that, the web server strips cookies and the authorisation header from the request, so the assistant cannot see the visitor's logged-in session either.

A live test from outside, through the public address, arriving the way a real attacker would (measured 2026-09-24): SQL and XSS patterns were rejected with a 403 by the assistant's own filter in 2–4 milliseconds, without calling the language model.

## What happens to someone who attacks it?

On an unambiguous attack, a RootCR system does not argue. The attacker gets back the data recorded about them (IP address, country, device, time, event ID) and a sentence saying that everything is logged. The IP address is blocked at the edge of the protective network in front of the website, for the whole site, within about a second, and the owner receives an email about the incident. Lifting the block is a manual decision.

A customer must never be blocked by mistake, so there are two levels: literal attacks are blocked immediately, ambiguous wording only after a repeated, confirmed suspicion. The test set (run 2026-09-24):

| What was measured | Result |
|---|---|
| Everyday customer questions, 44 of them with ambiguous wording (tourists writing in English, complaints, "from now on I'll buy all my bread from you") | 122 questions, none triggered an immediate block |
| Attack patterns in Hungarian, English and German, with hidden characters, SQL, XSS and command injection | of 70 patterns, 56 blocked immediately, 14 after a repeated, confirmed suspicion |

A separate process, walled off from the assistant, applies the block. Even if someone took over the assistant, they could not block or unblock anyone.

## What if something gets through anyway?

A RootCR assistant runs on the server as if it had already been compromised. The program has its own user, cannot write anywhere on the file system, is stripped of system-level privileges, and runs under memory and CPU limits. Its own firewall rule confines it: on the machine it can reach only its own database, it cannot reach internal networks at all, and outbound it can only open encrypted (HTTPS) connections.

A per-visitor request limit (per minute and per hour) stops mass probing and runaway costs: a bot on a single address cannot put a thousand questions to the model on your bill.

The same approach protects the whole server: [security and monitoring](/security-and-monitoring/).

## What does it log, and how does that make the assistant better?

For every conversation, a RootCR assistant records what was asked, how the system understood it, which path answered, from which source, what it replied and how long it took. The log is hash-chained, so any later edit is detectable; the assistant itself has no access to the log file. The visitor's IP address is stored only as a salted hash (attacks are the exception), and entries are deleted automatically after 90 days.

We do **not** train the model on your visitors' conversations. A conversation can contain personal data, and retraining does not fix a specific error in a targeted way. Instead, every wrong or evasive answer goes through the same loop:

1. the log review collects the answers that did not help;
2. I find the root cause: classification, search, data or rule;
3. I fix it, and the question becomes an automated test;
4. a change only goes live with a green test run, so the same error cannot come back.

As the owner you get an email about every conversation (what was asked, from which page, what was answered), and if the model provider is unreachable, an alert goes out before a visitor notices.

## What did the assistant learn in its first days?

Two real cases from the bucipek.hu log, fixed with the RootCR loop above.

**Hungarian word endings (2026-09-22).** Asked "When is the Buci run?", the assistant said it had no information, although the page was in its knowledge. The root cause: the search looked for literal matches, and Hungarian inflected question words did not match the page text; for 19 out of 25 real questions it found no matching page. The fix was a stemming search: of the 36-question measurement set, 34 are correct today, and the remaining two are known pure-synonym cases (measured 2026-09-24).

**The first real attack (morning of 2026-09-24).** A visitor coming from a data centre tried two well-known prompt injection patterns. The assistant gave nothing away, but the log revealed a point in the processing order where the filter could have run even earlier. It was fixed the same day, and the attacker's IP has been blocked from the whole site ever since.

## How fast is it?

A RootCR assistant is fastest where most questions land: data questions are answered by code, and the language model is not called at all. Measured on 80 real visitor questions on bucipek.hu (22–24 September 2026), from the arrival of the request to the finished answer, from the server log:

| Path of the answer | Questions | Median | For 90% of questions, at most |
|---|---|---|---|
| From data, by code (opening hours, price, address) | 27 | 0.7 s | 4.4 s |
| Written answer from the language model | 40 | 2.6 s | 4.7 s |
| All questions together | 80 | 2.1 s | 4.7 s |
| Rejecting an attack | 3 | about 1 millisecond | — |

The visitor's network time is not included. The chat panel's code only loads on click: when the page opens, only the corner button and a small still image arrive, so the panel costs nothing to visitors who never ask.

## What does it cost, and compared with what?

RootCR builds the assistant under a fixed-price quote, based on the data sources to connect, the languages and the interface. Running it has two monthly items: the language model's usage-based fee and operation. The source code and the log are yours.

For comparison, the list prices of off-the-shelf services (from the providers' own price lists, 2026-09-21):

| Service | Monthly fee | What you get |
|---|---|---|
| Chatbase Standard | $150 | 4,000 message credits, then $40 per 1,000 |
| Crisp Plus | $295 | live chat, about 1,350 AI conversations |
| Smartsupp Mira | €16 per 100 conversations | at most 20 pages read |

With your own assistant, the language model fee is a fraction of this: for 1,000 four-turn conversations a month, about $18 at the list price of a smaller language model and about $35 with a larger one (own calculation, 2026-09-21; the actual amount depends on traffic and on the model chosen).

## When should you NOT choose your own assistant?

RootCR does not recommend a custom assistant for every website. If your visitors ask three questions (opening hours, address, phone number), a well-written FAQ page is cheaper and faster. If you have a live support team and chat is their working tool (assignment, ticketing, shifts), a ready-made helpdesk serves you better. If you need something by tomorrow, an off-the-shelf service can be set up in a day.

A custom assistant pays off when a good answer depends on live data (stock, opening hours, price, allergens, orders), when security and data protection are not negotiable, and when you want to learn from the conversations yourself, rather than a platform learning from them.

## What I do not promise

There is no perfect filter for a language model. So RootCR assumes from the start that the filter can fail, and builds so that a failure does no harm:

1. **Small permissions.** If the filter fails, the model still cannot reach anything it could give away.
2. **Facts from code.** Price, time and allergen do not depend on how the model phrases things.
3. **Fast detection.** Every conversation is logged, and an attack triggers an immediate notification.

Visitors' questions are processed by the language model provider. We choose the provider together at the start of the project, according to your data protection requirements, and the privacy notice has to state it; bucipek.hu describes it in a dedicated section of its notice.

<div class="tldr"><strong>See it live before you write.</strong> In the bottom right corner of bucipek.hu, the Buci AI answers in Hungarian and English. Try it with a normal question, and try it with a trick. If you would like something similar on your own site, <a href="#contact" data-tema="chatbot">tell me what your visitors ask about</a>, and I will tell you how much of it an assistant can genuinely answer well.</div>

## Frequently asked questions

### Can it be added to an existing website?

Yes. If the site is custom-coded, the interface becomes part of it. On another platform (WordPress, Shopify, WooCommerce) an embedded element is added, and the assistant runs separately, on its own server. It reads live data from that platform's database or API, with read-only rights.

### How long does it take to build an AI assistant?

The first live version of the bucipek.hu assistant went into service within two days of the decision (21–22 September 2026). Since then it has improved from real questions, through the four steps above. The exact deadline is in the quote, as a fixed date.

### Could it leak my customers' data?

No, because it cannot see it. To the assistant's database user, the accounts and orders tables do not exist, and the web server strips cookies and the authorisation header. That is why on bucipek.hu the question "where is my order?" is answered by a colleague, not by the assistant.

### What happens when it does not know the answer?

It says so and refers the visitor to the colleague for that topic: the ordering address for orders, the wholesale address for trade enquiries. It does not dodge the question or invent an answer, because the model can only write from what code has handed to it.

### Does it speak other languages?

The bucipek.hu assistant answers in Hungarian and English. Translations of code-generated answers are checked: if a number, a time or a link would be lost in translation, the Hungarian original is sent instead, marked as such. Further languages can be added per project.

### Who owns the assistant?

You do. At handover, the full source code, the configuration and the log are yours, as with every RootCR project. You are not renting a platform for a monthly fee that can raise its prices or shut down at any time.