Security and data protection

1. Allocation of responsibilities

The customer real estate company is the data controller for the people who call it. Kobem acts as processor: it handles that data on the customer’s instructions and for the provision of the service, never for purposes of its own.

That split is not a statement of intent. It is set out in the Data Processing Addendum, which forms part of the contract and contains the obligations required by Article 28(3) GDPR.

Three consequences follow from that allocation: title to the data rests with the customer; Kobem neither sells it nor transfers it to third parties for its own purposes; and the customer may export it in full on termination.

2. Location of the data

Each component of the service runs on separate infrastructure. Their locations are as follows:

• Database and recordings: Supabase, on AWS infrastructure in Ireland (eu-west-1). European Union territory.
• Web application and API: Vercel, with server functions pinned to Dublin (eu-west-1), the same region as the database. European Union territory.
• Call audio, while the call happens: LiveKit Cloud. The voice agent runs in the European region; the session metadata LiveKit keeps for analytics — duration, participant identifiers and connection quality — is stored in the United States. LiveKit keeps neither the audio nor the transcript: agent observability is disabled.
• Voice model and transcription: United States. The audio of the conversation leaves the European Union while the call is in progress.

We say it because it is the question nobody asks and everybody should: stored data sits in the EU — except LiveKit session metadata, in the United States — but live audio crosses US providers. Those transfers rely on the European Commission's standard contractual clauses.

3. Protection measures

• In transit: all traffic is encrypted with TLS. No call and no query travels in the clear.
• At rest: AES-256 disk encryption on the database and on the recording store.
• Your third-party credentials: HubSpot, Google Calendar and Cal.com credentials are encrypted a second time with AES-256-GCM before storage, using a key that does not reside in the database. Access to the table would not permit their use.
• Isolation between customers: all 22 tables have row-level security enabled, and on top of that every query filters by account in the code. They are two independent barriers: for one company to see another's data, both would have to fail at once.
• Recordings have no permanent link: the audio sits in a private store and its address is never published. Each playback generates a signed link that expires in 60 seconds.
• Access by our team: any access by Kobem personnel to a customer account for support purposes is logged with the operator’s identity and a timestamp.

4. Sub-processors

Answering a call requires third parties: whoever carries the audio and the model that hears it, understands it and replies. They are all named, one by one, with their role and their location, in the Privacy Policy. The list is exhaustive and is updated on each addition of a sub-processor, in accordance with Article 28(2) GDPR.

None of those providers uses the conversations processed to train their models. This is not a setting chosen by Kobem but a contractual condition of the paid APIs under contract.

Nor do they have access to the database. The database provider offers an assistant that can read the schema, the logs or the data itself; in Kobem's organisation it is disabled, which is the level that shares nothing. This can be verified immediately in the provider's dashboard.

5. Call recording and prior notice

The recording notice comes in the first sentence, before anything else, and cannot be removed while recording is on: in the code the two are tied together, so turning one on turns the other on.

That coupling reflects a legal requirement. In the UAE, recording without prior notice is a criminal offence (Article 431 of the Penal Code); in Spain it requires a legal basis and prior notice. The customer may reword the notice from the dashboard but may not remove it.

6. Retention and deletion

The periods below describe how the service operates today, not a planned target:

• The customer may delete any call, together with its recording and transcript, from the dashboard at any time.
• On closure of the account, all content whose retention is not required by law is deleted.
• There is no automatic deletion by age yet. It is planned — 30 days for recordings — and this document will state the exact period once it takes effect. Until then no automatic deletion by age takes place.
• Accounting data is kept for the years tax rules require.

7. Certifications and roadmap

We state precisely what we hold today and what is on the way. This is the part a buyer verifies, and we would rather they verified it against what we say:

• Formal certifications: Kobem does not currently hold SOC 2 or ISO 27001. That said, the controls those standards require are described one by one, and in auditable form, in Schedule 2 of the Data Processing Addendum. We would rather publish the controls than display a badge we do not have.
• Two-factor authentication: administrative access to our infrastructure providers already requires it. For customer access to the dashboard it is in development.
• Automatic deletion by age: in development, with a planned period of 30 days for recordings. Deletion is currently immediate and carried out by the customer from the dashboard.
• Data residency: data is stored in the European Union. For a UAE customer that constitutes an international transfer, documented and covered by Schedule 3 of the Data Processing Addendum.

Where any of these points constitutes a formal requirement for the customer’s organisation, Kobem will state before signature whether it can meet it and within what timeframe.

8. Incident notification

If a security breach affecting personal data occurred, the customer will be notified without undue delay and in any case within 72 hours of becoming aware of it, with what we know at that point: what happened, which data it affects and what we are doing about it. Notice will be given equally where the breach originates with a sub-processor rather than with Kobem’s own infrastructure.

9. Contact

For any question regarding this document, for the exercise of the rights of access, rectification, erasure, objection, restriction or portability, or to request a signed Data Processing Addendum: contact@kobem.ai. Messages sent to that address are handled directly by the Kobem team.

10. Technical and organisational measures

The full set of measures, in the format of Annex II to the European Commission's Standard Contractual Clauses. It is the same table that appears in Schedule 2 of the Data Processing Addendum, so that the two documents cannot contradict each other.

11. Documentation

The statements above are supported by the following contractual documents:

• Terms of Service — The service agreement: what you contract, what it covers, how it is paid and how it ends.
• Privacy Policy — What personal data we process, for what purpose, on what legal basis and what rights you have.
• Data Processing Addendum — The contract required by Article 28 GDPR between your company, as controller, and Kobem, as processor.
• Sub-processors — Every provider involved in the service, one by one, with their role and where they process data.
• Acceptable Use Policy — What Kobem may not be used for. It protects callers, and it protects other customers too.
• Cookie Policy — What we store in your browser and what for.
• Legal Notice — Who we are: corporate name, registration, licence and registered address.