Security and data protection

1. Division of responsibilities

The customer is the controller of the data of the people who call it. Kobem acts as processor: it processes that data on the customer's instructions and to provide the service.

That division is governed by the Data Processing Addendum, which forms part of the contract.

The data belongs to the customer: Kobem does not sell it, and the customer can take it when leaving.

2. Data location

• Database and recordings: European Union.
• Web application and API: European Union.
• Voice engine: European Union, with session metadata in the United States.
• Call voice and analysis: United States.

When a transfer requires a safeguard, we use the European Commission's standard contractual clauses or another valid mechanism.

3. Protection measures

• In transit: the website, dashboard, APIs and browser audio are encrypted with TLS and DTLS-SRTP.
• At rest: the database and recordings are encrypted with AES-256.
• Third-party credentials: credentials for connected tools are encrypted with AES-256-GCM before being stored.
• Isolation between customers: each account's data is separated with row-level security in the database.
• Recordings: they are held in a private store and played through short-lived signed links.
• Team access: only authorised Kobem staff access customer data, to provide support, maintain the service and fix errors.

4. Sub-processors

Kobem relies on providers to deliver the service. The list, with their role and location, is in Sub-processors.

Artificial-intelligence providers do not use conversation content to train their models.

5. Call recording

Calls are recorded, and the caller hears a notice in the greeting. The customer may reword the notice from the dashboard but must not remove it.

The customer is responsible for complying with the recording rules that apply to it.

6. Retention and deletion

• Calls are kept for the term of the subscription. The customer can remove any call from their dashboard and request its permanent deletion at contact@kobem.ai.
• When the contract ends, the customer has thirty days to export their data. It is then deleted, except what must be kept by law.
• Accounting data is kept for the years required by tax rules.

7. Incident notification

If a security breach affects a customer's personal data, Kobem notifies them without undue delay and in any event within 72 hours of becoming aware of it.

8. Documentation

The full terms and the technical and organisational measures are in these documents:

• Terms of Service — The service agreement: what you contract, what it covers, how it is paid and how it ends.
• Privacy Policy — What personal data we process, for what purpose, on what legal basis and what rights you have.
• Data Processing Addendum — The contract required by Article 28 GDPR between your company, as controller, and Kobem, as processor.
• Sub-processors — The providers involved in the service, with their role and where they process data.
• Acceptable Use Policy — What Kobem may not be used for. It protects callers, and it protects other customers too.
• Cookie Policy — What we store in your browser and what for.
• Legal Notice — Who we are: corporate name, registration, licence and registered address.

9. Contact

For any question about security or data protection, or to exercise your rights, write to contact@kobem.ai.