CocciFlows Business Documentation

For the AI Customer Service Agent - Business (v1.0.0). Starter answers; Business understands and routes. The same guides ship inside your download, in START_HERE.md and docs/. Starter's documentation is here.

1 · Requirements

Every key and password goes into your n8n's encrypted credential store. None is written to a file, a workflow, a log or the website snippet. The Console keeps them in memory only until you close it.

2 · Self-hosted n8n

Everything in Business works on self-hosted n8n. Two settings in n8n's environment matter:

• Failed runs: keep pruning on and keep failed runs for 7 days: EXECUTIONS_DATA_PRUNE=true and EXECUTIONS_DATA_MAX_AGE=168. See privacy for why.
• Supabase: add NODE_EXTRA_CA_CERTS=/path/to/prod-ca-2021.crt (Supabase's certificate) so n8n can verify Supabase. Restart n8n after changing either.

3 · n8n Cloud limitations

• Supabase cannot be used. Supabase's certificates are signed by Supabase's own authority. n8n Cloud does not let you add an authority, and CocciFlows never turns certificate checks off, so the Console does not offer Supabase on n8n Cloud.
• Recommended stores on n8n Cloud: Google Sheets for a small installation, or PostgreSQL with a certificate from a publicly trusted authority.
• Run retention: how long n8n Cloud keeps failed runs is set by your n8n Cloud plan. CocciFlows cannot configure it. You can delete runs yourself in n8n, under Executions.

4 · Conversation stores

For Supabase and PostgreSQL the Console writes a short setup script that you run once as the database administrator. CocciFlows never asks for the administrator password. If the store cannot be reached, conversations carry on without memory and are not recorded, and the Console says so plainly.

5 · Knowledge limits

Scanned PDFs are not supported. There is no OCR: a PDF that is mostly images is refused. Export it as a text PDF or Word file, or paste the text in. Encrypted PDFs and legacy .doc files are refused too. Indexing runs on your computer with your OpenAI key, and re-indexing is manual.

6 · Install and go live

1. Unzip the download to a permanent folder and start the Console (Windows, macOS or Linux launcher). Open http://127.0.0.1:7379.
2. Enter your real business name and details, connect n8n, add your OpenAI key.
3. Add and index your documents, choose and connect the store, set the weekly digest.
4. Set SMTP and your escalation routes (email, Slack, Teams, webhook), qualification and routing rules.
5. Set answer budgets, memory and allowed websites, then brand the widget.
6. Press Install in n8n: the Console creates the credentials, installs and publishes the workflows, and links the assistant to Knowledge Search, memory and the store.
7. Run the health checks: n8n access and version, every workflow published, run-history settings, the index current, and a real test conversation answered, recorded in your store and deleted again.
8. Copy the widget snippet into your website. It holds no key or secret.

7 · Upgrading from Starter

Already own Starter? The upgrade is $80. Business takes over Starter's public address, so the chat on your website keeps working; widget v2 is optional.

1. Connect the same n8n Starter runs in, and import Starter's setup/setup-state.json. Business details, escalation address and valid n8n credentials are reused; Starter's FAQs become a Business document.
2. Stage: Business is installed on a temporary address and health-checked while Starter keeps serving.
3. Switch: Starter is switched off at the last moment, Business takes the address, and a real conversation through the public address is confirmed in your store.
4. If the switch fails, Starter is switched back on automatically. Go back to Starter is available at any time. Starter is never deleted.

Business, and Starter 1.1.7 or newer, work with n8n's standard security settings. If an older Starter (1.1.6 or earlier) had you set N8N_BLOCK_ENV_ACCESS_IN_NODE=false, update Starter to 1.1.7 or newer first, then remove that setting.

8 · Privacy and retention

• Conversations go from your website to your n8n, your OpenAI account and your store. CocciFlows has no server in that path and receives none of it.
• History is kept for your retention setting, 1 to 730 days (default 90), and deleted automatically. You can choose to keep no message text at all.
• The Console exports everything about one customer, deletes one customer or one conversation, and purges all history.
• Returning customers are recognised by a pseudonymous contact id, an HMAC with a key unique to your installation. It is personal data, not anonymous. Insights and the digest never show an email, phone number or contact id.

Failed runs hold data outside your store. Business keeps no successful runs, and the knowledge, memory and store workflows keep none at all. The agent, escalation and digest workflows keep failed runs only. A failed agent run contains that turn's message, contact details, retrieved passages and history (never a credential). It is outside your retention and the Console's privacy tools until n8n prunes it: 7 days on self-hosted n8n with the setting above, or your n8n Cloud plan's period, which CocciFlows cannot change. You can delete runs in n8n at any time.

You keep your customers' conversations, so say so in your own privacy notice. The Console drafts a paragraph from your settings. How CocciFlows itself handles purchase data is in our Privacy Notice.

9 · Estimated AI costs

Business is $129 one-time. You pay n8n, OpenAI, your store and your email provider directly. With the default model, gpt-4.1-mini (US$0.40 input and US$1.60 output per million tokens), one answer is estimated at about $0.0015 (about 3,000 input and 200 output tokens), and at most about $0.0026 at the default settings: roughly $1.50 to $2.60 per 1,000 answers. Indexing the largest knowledge base costs about one cent.

Estimates only; your OpenAI bill is the real figure. Prices: OpenAI's standard-tier API prices for gpt-4.1-mini and text-embedding-3-small, confirmed on OpenAI's official pricing page on 7 October 2026. Prices change; check that page before relying on these figures. Not included: taxes, cached-input or batch discounts, retries, and other use of the same key. Insights labels every cost as estimated and reports an unknown model as unpriced.

10 · Signed webhooks

Each delivery carries X-CocciFlows-Event, X-CocciFlows-Event-Id, X-CocciFlows-Timestamp and X-CocciFlows-Signature (v1= hex HMAC-SHA256 of v1:<timestamp>:<event id>:<body>). The body has two identifiers:

• eventId: unique to each notice and route, and reused by n8n's retries. Drop one you have already accepted.
• dedupeKey: the same for the same kind of notice about the same conversation (v1|installation|event|band or reason|conversation). Use it to avoid two tickets for one lead.

Verify the signature in constant time, refuse timestamps more than five minutes away, and refuse a body whose event or event id differs from the headers.

11 · Backups, updates, uninstall

• Backups: your store's own backups for history; a copy of the Business folder (including data/, which holds no secret) for your setup and knowledge; your n8n's own backup for workflows and credentials.
• Updates: 1.x updates are free. Unzip the new version, copy in your data/ folder, install again and run the health checks. The address and contact key stay the same.
• Uninstall: in step 8, type UNINSTALL. Workflows and the credentials the Console created are removed from n8n. Your history stays in your store until you export or purge it; the contact key is kept for a reinstall. After a Starter upgrade, go back to Starter before uninstalling.

12 · Support

Start with the troubleshooting guide in your download. Need a human? Email support@coccitech.ae. Include your Business version, n8n version, whether n8n is self-hosted or Cloud, your store, and what the Console said. Support will never ask for keys, passwords or customer conversations.