Robocaller

Security

How we protect the data in your workspace and the accounts you connect, and how to tell us about a security problem.

Updated
Company
Gibox Oy, business ID 3522481-3

In short

  • Robocaller runs on our server in Helsinki, and your data is stored in a database in the EU. Call recordings are the exception: our telephony provider keeps them.
  • All traffic is encrypted, and the keys to your email accounts are encrypted again before we store them.
  • Your messages, calls and deals stay in your workspace, and admins decide what each member can do.
  • Found a vulnerability? Email support@robocaller.io and we’ll confirm we got it within 3 business days.
On this page
  1. Where your data is
  2. Encryption
  3. Who can see your data
  4. Connected accounts
  5. How we build and run the service
  6. If something goes wrong
  7. Report a vulnerability
  8. Security reviews

Where your data is

  1. Your browserEncrypted connection (TLS)
  2. Robocaller appOur cloud server in Helsinki, Finland
  3. Database and filesAn EU data centre in France

The accounts you connect, such as Gmail, Outlook and LinkedIn, receive what they need to send your messages. They are your own accounts, not our subprocessors. Our subprocessor overview shows which kinds of providers process data for us, what they receive and where.

The app server’s passwords and keys are kept in a separate secrets service, and the server loads them into memory when the app starts.

Encryption

  • Connections to the app and between our services use TLS.
  • The database and stored files are encrypted at rest.
  • Access tokens for connected Gmail and Outlook accounts are encrypted again before they are saved, with a key kept outside the database. If encryption fails, the token is not saved.
  • Gmail and Outlook normally connect through Google’s and Microsoft’s own sign-in, so we don’t see your email password. If you connect Gmail with a Google app password instead, it is encrypted in the same way.

Who can see your data

  • Every request is checked against the workspace it belongs to, so other customers can’t see your messages, calls or deals. Company and contact details can also appear in our shared lead database, as our privacy notice explains.
  • Workspace owners and admins choose each member’s role and which features they can use.
  • You sign in with your Google or Microsoft account, or with an email address and password.
  • At Gibox, only named people can access the production systems or open a customer’s workspace, and only to run and support the service.

Connected accounts

You can disconnect an email account, a LinkedIn account or a phone number in Settings at any time. You can also remove Robocaller’s access in your Google or Microsoft account settings.

LinkedIn accounts connect through a LinkedIn connection provider, and calls and text messages go through a telephony provider. Call recordings are stored by the telephony provider, which may process them in the United States. They play inside Robocaller, and only members of your workspace, and the named Gibox staff mentioned above, can open them.

How we build and run the service

  • Every code change runs automated tests and a scan for passwords or keys left in the code.
  • Messages from our telephony and payment providers are accepted only with a valid signature.
  • Features that open web addresses for you check every address and every redirect, so they can’t reach our internal network.

If something goes wrong

If we learn of a personal data breach that affects your workspace, we tell you without undue delay, with what we know at that point, and keep you updated as we learn more. That helps you meet your own duty to report the breach to the Data Protection Ombudsman within 72 hours.

Report a vulnerability

Email support@robocaller.io. Please don’t post about the problem publicly before we have fixed it. Tell us:

  • what the problem is and what it affects
  • how to reproduce it, or a proof of concept
  • the pages, features or addresses involved, if you know them

We confirm we got your report within 3 business days and send our assessment within 7 business days. Please give us reasonable time to fix the problem before you disclose it.

When testing, use only accounts and data that are yours, and don’t try to disrupt the service or read other customers’ data.

Security reviews

We don’t hold SOC 2 or ISO 27001 certification. If your company sends a security questionnaire, we’ll answer it, and you can ask for our data processing agreement.

Questions about this page?

Email support@robocaller.io.