Trust Centre

At a glance

Documents

• Security OverviewEncryption, access, logging, incident response, retention
• Data Processing AddendumOur commitments as your processor, with technical and organisational measures (Annex D)
• Sub-processorsWho processes customer data for us, where, and how you hear about changes
• Privacy PolicyWhat we collect, why, and your rights
• Vulnerability Disclosure PolicyHow to report a security issue, and what to expect
• security.txtMachine-readable security contact (RFC 9116)
• Brief for IT administratorsWhat Sigbot can read in Microsoft 365, and how to approve it for your organisation
• Roles and permissionsWhat each team role can do
• If your details are in SigbotA notice for the people in your contact book, with a paragraph for your own privacy notice

Certifications and assurance

We are a young company and would rather tell you where we stand than imply more. Today Sigbot holds no security certification.

Our infrastructure providers hold their own independent certifications: Google Cloud, which stores and processes customer data, and Vercel, which serves the web app, both publish ISO/IEC 27001 and SOC 2 reports.

Security features for your team

Every team plan includes:

• Two-step verification you can enforce — for admins only or for everyone in the team.
• Session limits — make members sign in again after a set time, from 1 hour to 30 days, and sign people out everywhere when they are removed.
• Audit log with CSV export — a year of sign-ins, membership changes, mailbox connections and exports, which owners and admins can filter and download as CSV.
• Roles and folder permissions — control who can see, edit, share and export contacts. See Roles and permissions.

The Enterprise plan adds:

• Single sign-on with Microsoft Entra ID, Okta or any SAML 2.0 identity provider, which you can make the required way to sign in for your team.
• SCIM user provisioning, so people are added and removed from your identity provider.
• Audit log streaming — every audit log entry sent, signed, to your own security tools as it happens.
• A read-only API for your contact data. It is new, so we set it up together on a call.

How we look after your data

• Everything travels over TLS; data is encrypted at rest, and mailbox access tokens carry an extra layer of AES-256-GCM encryption.
• Only the signature block of an email (at most 4,000 characters) is ever sent to our AI provider, and you can switch AI parsing off for your account or your team.
• Database rules keep each account and team to its own records, and every team action is checked on our servers.
• Security logs of refused sign-ins, failed requests and administrative actions are kept for 400 days in a locked store.
• Backups run daily, and we can restore any record to how it was at any point in the last 7 days.
• We have a written incident response plan, and our DPA commits us to tell you of a personal data breach within 72 hours of becoming aware of it.

The detail is in the Security Overview and DPA Annex D.

Approving Sigbot in Microsoft 365

Most organisations on Microsoft's default settings need an IT administrator to approve Sigbot once for the whole organisation before staff can connect their Outlook mailboxes. The brief for IT administrators explains exactly what Sigbot can read and how to approve it.

Questionnaires and contacts