In this guide · 8 sections
- 01What you are actually buying from a chatbot company
- 02Questions about the AI model and your data
- 03Handover to a human and what the bot is allowed to say
- 04Security testing: prompt injection and leaks
- 05Costs that grow after launch: WhatsApp, usage and seats
- 06Contract and exit terms
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Ask every provider which AI model it uses and where your data goes, how the bot hands over to a human, how it was tested against prompt injection, what each WhatsApp or web conversation costs at your volume, and how you get your content and data back if you leave.
What you are actually buying from a chatbot company
An AI chatbot has four parts: the language model that writes the answers, the knowledge it draws on (your FAQs, prices, policies), the channel (website widget, WhatsApp, Instagram), and the rules around it (what it may not say, when it hands over to staff). Providers rarely build the model; they rent it from OpenAI, Anthropic, Google or an open-model host.
That means two providers quoting very different prices may run the same model. You are paying for the setup, the knowledge base, the guardrails, the inbox your staff use, and support when it gets something wrong. Compare on those, not on claims about how smart the AI is. If you want to understand the cost side first, our guide to AI chatbots for Singapore websites covers typical prices and setup.
Questions about the AI model and your data
Start here, because the answers decide your PDPA position. PDPC's Advisory Guidelines on Use of Personal Data in Generative AI (published 20 July 2026) treat the business that deploys an AI system as primarily responsible, not the vendor. Our summary of the PDPC generative AI guidelines explains the roles.
| Ask | A good answer | A worrying answer |
|---|---|---|
| Which model and version do you use? | Names the provider and model, and says how upgrades are handled | "Our own proprietary AI" with no detail |
| Where are chats processed and stored? | Names the cloud regions and sub-processors | Doesn't know, or "somewhere secure" |
| Is our data used to train any model? | No, with the contract or API terms to prove it | Vague, or "to improve the service" |
| How long are chat logs kept? | A set period you can change, with deletion on request | Forever, or no answer |
| Who on your team can read our chats? | Named roles, with access logged | Everyone, for support |
The provider will usually be your data intermediary for the chat data, so put PDPA clauses in the contract. Our guide to data intermediary clauses in vendor contracts lists them.
Handover to a human and what the bot is allowed to say
The most common failure is not a wrong fact but a bot that keeps answering when it should stop. Ask the provider to show you, in a live demo, what happens in each of these cases:
- A customer asks to speak to a person. Does the chat go to a staff inbox with the history attached, and what happens outside office hours?
- A question the knowledge base does not cover. Does the bot say it doesn't know, or does it guess?
- A complaint, refund request or anything medical, legal or financial. Is it routed straight to staff?
- A customer types their NRIC, card number or health details. Is it masked, or stored in plain text in the logs?
- A question in Chinese, Malay or Singlish. Does it answer in kind, and stay within your rules?
Ask how answers can be checked. A good provider shows which source document each answer came from and lets you correct the knowledge base yourself, without a support ticket.
Security testing: prompt injection and leaks
Prompt injection is when a user (or text the bot reads, such as a web page or uploaded file) tricks the model into ignoring its instructions. It is LLM01, the top risk, on the OWASP Top 10 for LLM Applications 2025, followed by sensitive information disclosure. System prompt leakage and excessive agency (giving the bot more powers than it needs) are also on the list. Our explainer on prompt injection shows how these attacks work.
Ask the provider for its test notes: which injection attempts it tried, what the bot did, and what was fixed. Then try a few yourself before launch: ask it to ignore its instructions, to reveal its system prompt, to offer a 90% discount, and to show another customer's booking.
Costs that grow after launch: WhatsApp, usage and seats
Quotes often show a setup fee and a monthly platform fee. The bills that surprise owners come later. Ask for a written estimate at your expected volume for each of these:
- Setup and knowledge base buildAsk what is included: pages, FAQs, languages, testing roundsOne-off
- Platform or licence feeCheck whether it is per bot, per channel or per staff seatMonthly
- AI usageAsk whether there is a cap and what happens when you hit itPer conversation or per message
- WhatsApp messagesCharged by Meta, often with a provider mark-up on topPer delivered message (Meta)
- Changes after launchNew services, price changes, new languagesHourly or included
What to compare12-month total at your real volume
Ask each provider to fill in the same table so you can compare like for like.
Meta charges per delivered WhatsApp message, with different rates for marketing, utility and service messages. Our guide to WhatsApp Business API costs in Singapore has the current Singapore rates and worked examples. Ask the provider whether it passes Meta's charges through at cost or adds a margin.
Contract and exit terms
You will want to change provider one day, or bring the bot in-house. Settle these points before you sign:
Before you sign with a chatbot provider
If the provider owns the WhatsApp number or Meta account, moving away can mean losing a number your customers know. That one point is worth more than a cheaper monthly fee.
Do it yourself or get help?
If you only need a simple FAQ bot on your website and are comfortable editing a knowledge base, an off-the-shelf live chat tool with an AI add-on can be set up in a day. Tools such as Tidio, Crisp and Intercom all offer one.
If you want it built on accounts you own, with tested guardrails and a clean handover to staff, our AI Website Assistant (S$790) sets up a bot trained on your content, with human handover and PDPA-safe settings. WhatsApp Notifications (S$590) connects booking or order updates to WhatsApp on your own Meta account.
Frequently asked questions
Very few do. Most build on large language models from OpenAI, Anthropic or Google, or on open models run by a cloud host, and add their own knowledge base, rules, inbox and integrations. Ask which model and version they use, and how they handle model upgrades and retirements.
PDPC's July 2026 guidelines on generative AI treat the business that deploys the system as primarily responsible. The provider is usually your data intermediary, so it must protect the data and tell you about a breach. You still need contract clauses, sensible retention and a plan for notifying PDPC if required.
Ask questions outside your business, request a big discount, ask it to ignore its instructions or reveal its system prompt, ask for another customer's details, and ask for medical, legal or financial advice. Check it in Chinese, Malay and Singlish too. Every wrong answer should lead to a fix in the rules or knowledge base.
Usually yes, because Meta charges per delivered message on the WhatsApp Business Platform, on top of the provider's fees and AI usage. A website widget has no per-message charge from a third party. Many businesses start on the website and add WhatsApp for confirmations and reminders.
The chat should move to a staff inbox with the full history, the customer should be told when to expect a reply, and outside office hours the bot should take a message rather than keep guessing. Complaints, refunds and anything medical, legal or financial should go straight to staff.