Security and data protection
Last updated: 18 September 2026
This document sets out the technical and organisational measures Kobem applies to the processing of personal data, the allocation of responsibilities between the customer and Kobem, the location and retention periods of the data, the sub-processors involved and the incident notification procedure. It is published as a due diligence reference and is updated whenever the measures it describes change.
Service provider
The service is provided by KOBEM TECHNOLOGIES - FZCO, a free zone company with limited liability (FZCO) incorporated in Dubai Silicon Oasis under Dubai Law No. 16 of 2021 and the DIEZA Implementing Regulations 2023, registration No. 85517 and trade licence No. 92297, issued by the Dubai Integrated Economic Zones Authority (DIEZA), with registered address at IFZA Properties, Premises DSO-IFZA, Dubai Silicon Oasis, Dubai, United Arab Emirates.
Data protection contact and single point of contact for any matter concerning this document: contact@kobem.ai.
1. Allocation of responsibilities
The customer real estate company is the data controller for the people who call it. Kobem acts as processor: it handles that data on the customer’s instructions and for the provision of the service, never for purposes of its own.
That split is not a statement of intent. It is set out in the Data Processing Addendum, which forms part of the contract and contains the obligations required by Article 28(3) GDPR.
Three consequences follow from that allocation: title to the data rests with the customer; Kobem neither sells it nor transfers it to third parties for its own purposes; and the customer may export it in full on termination.
2. Location of the data
Each component of the service runs on separate infrastructure. Their locations are as follows:
- Database and recordings: Supabase, on AWS infrastructure in Ireland (eu-west-1). European Union territory.
- Web application and API: Vercel. Server functions may execute outside the EU.
- Call audio, while the call happens: LiveKit Cloud, European region.
- Voice model and transcription: United States. The audio of the conversation leaves the European Union while the call is in progress.
We say it because it is the question nobody asks and everybody should: stored data sits in the EU, but live audio crosses US providers. Those transfers rely on the European Commission's standard contractual clauses.
3. Protection measures
- In transit: all traffic is encrypted with TLS. No call and no query travels in the clear.
- At rest: AES-256 disk encryption on the database and on the recording store.
- Your third-party credentials: HubSpot, Google Calendar and Cal.com credentials are encrypted a second time with AES-256-GCM before storage, using a key that does not reside in the database. Access to the table would not permit their use.
- Isolation between customers: all 22 tables have row-level security enabled, and on top of that every query filters by account in the code. They are two independent barriers: for one company to see another's data, both would have to fail at once.
- Recordings have no permanent link: the audio sits in a private store and its address is never published. Each playback generates a signed link that expires in 60 seconds.
- Access by our team: any access by Kobem personnel to a customer account for support purposes is logged with the operator’s identity and a timestamp.
4. Sub-processors
Answering a call requires third parties: whoever carries the audio, whoever turns it into text and the model that holds the conversation. They are all named, one by one, with their role and their location, in the Privacy Policy. The list is exhaustive and is updated on each addition of a sub-processor, in accordance with Article 28(2) GDPR.
None of those providers uses the conversations processed to train their models. This is not a setting chosen by Kobem but a contractual condition of the paid APIs under contract.
5. Call recording and prior notice
The recording notice comes in the first sentence, before anything else, and cannot be removed while recording is on: in the code the two are tied together, so turning one on turns the other on.
That coupling reflects a legal requirement. In the UAE, recording without prior notice is a criminal offence (Article 431 of the Penal Code); in Spain it requires a legal basis and prior notice. The customer may reword the notice from the dashboard but may not remove it.
6. Retention and deletion
The periods below describe how the service operates today, not a planned target:
- The customer may delete any call, together with its recording and transcript, from the dashboard at any time.
- On closure of the account, all content whose retention is not required by law is deleted.
- There is no automatic deletion by age yet. It is planned — 30 days for recordings — and this document will state the exact period once it takes effect. Until then no automatic deletion by age takes place.
- Accounting data is kept for the years tax rules require.
7. Certifications and roadmap
We state precisely what we hold today and what is on the way. This is the part a buyer verifies, and we would rather they verified it against what we say:
- Formal certifications: Kobem does not currently hold SOC 2 or ISO 27001. That said, the controls those standards require are described one by one, and in auditable form, in Schedule 2 of the Data Processing Addendum. We would rather publish the controls than display a badge we do not have.
- Two-factor authentication: administrative access to our infrastructure providers already requires it. For customer access to the dashboard it is in development.
- Automatic deletion by age: in development, with a planned period of 30 days for recordings. Deletion is currently immediate and carried out by the customer from the dashboard.
- Data residency: data is stored in the European Union. For a UAE customer that constitutes an international transfer, documented and covered by Schedule 3 of the Data Processing Addendum.
Where any of these points constitutes a formal requirement for the customer’s organisation, Kobem will state before signature whether it can meet it and within what timeframe.
8. Incident notification
If a security breach affecting personal data occurred, the customer will be notified without undue delay and in any case within 72 hours of becoming aware of it, with what we know at that point: what happened, which data it affects and what we are doing about it. Notice will be given equally where the breach originates with a sub-processor rather than with Kobem’s own infrastructure.
9. Contact
For any question regarding this document, for the exercise of the rights of access, rectification, erasure, objection, restriction or portability, or to request a signed Data Processing Addendum: contact@kobem.ai. Messages sent to that address are handled directly by the Kobem team.
10. Technical and organisational measures
The full set of measures, in the format of Annex II to the European Commission's Standard Contractual Clauses. It is the same table that appears in Schedule 2 of the Data Processing Addendum, so that the two documents cannot contradict each other.
| Measure | How it is met |
|---|---|
| Pseudonymisation and encryption of personal data | All traffic is encrypted in transit with TLS 1.2 or above, and real-time audio with DTLS-SRTP under the WebRTC standard. Data at rest is encrypted with AES-256 in the database and in the recording store. Customer integration credentials are further encrypted with AES-256-GCM before storage, using a key that does not reside in the database. |
| Confidentiality, integrity, availability and resilience of processing systems | The infrastructure runs on providers with redundancy and automatic recovery (AWS via Supabase, and Vercel). The database replicates automatically and object storage is redundant by the provider's design. |
| Ability to restore availability and access to data after an incident | Automatic daily database backups, retained by the provider, with point-in-time recovery. Restoration is performed manually following the provider's procedure. |
| User identification and authorisation | Each user signs in with their own account, managed by Supabase Auth. Kobem staff access to a customer account is granted on a support-need basis and is written to an audit log with the actor and the time. Administrative access to infrastructure providers requires two-factor authentication. |
| Isolation of data between customers | Every table holding customer data has PostgreSQL row-level security (RLS) enabled, and in addition every server query filters by account identifier in code. These are two independent controls: isolation between two customers requires both to fail. |
| Protection of data during transmission | No data travels in the clear. Service security headers include HSTS, a strict referrer policy, protection against framing by third parties and blocking of content-type sniffing. On routes where a session identifier travels in the URL, no referrer is sent at all. |
| Protection of data during storage | Recordings are held in a private store whose address is never published: each playback generates a signed link that expires after sixty seconds. The database stores the file path, never a permanent address. |
| Physical security of processing locations | Kobem operates no data centres of its own. Physical processing is carried out by the infrastructure providers identified in the sub-processor list, in their certified facilities. |
| Event logging | Administrative access to a customer account is written to an audit log. The platform also retains execution logs for the service and for the handling of each call. |
| System configuration and secret management | No credential is written into the source: all are injected as environment variables by the hosting provider, and files that could contain them are excluded from version control. Elevated-privilege keys are used on the server only and are never exposed to the browser. |
| Data minimisation | Only the data necessary to provide the service is processed, as described in Schedule 1. The dashboard warns the customer when a question they configure may touch a special category of data under Article 9 GDPR, and records that warning. |
| Limited data retention | Retention periods are those in Schedule 1. The customer can delete any call, with its recording and transcript, at any time and without our involvement. No artificial-intelligence provider retains conversation content or uses it to train models. |
| Portability and erasure | The customer can view, export and delete data from their dashboard without Kobem's involvement. Requests they cannot resolve themselves are handled by writing to contact@kobem.ai. |
| Technical and organisational measures of sub-processors | Kobem engages each sub-processor under a data processing agreement with protection obligations equivalent to those in this Addendum, and remains liable to the customer for the performance of all of them. |
11. Documentation
The statements above are supported by the following contractual documents:
- Terms of Service — The service agreement: what you contract, what it covers, how it is paid and how it ends.
- Privacy Policy — What personal data we process, for what purpose, on what legal basis and what rights you have.
- Data Processing Addendum — The contract required by Article 28 GDPR between your company, as controller, and Kobem, as processor.
- Sub-processors — Every provider involved in the service, one by one, with their role and where they process data.
- Acceptable Use Policy — What Kobem may not be used for. It protects callers, and it protects other customers too.
- Cookie Policy — What we store in your browser and what for.
- Legal Notice — Who we are: corporate name, registration, licence and registered address.