Employee communication means sensitive data. We take it seriously at every level: from EU hosting and GDPR compliance, through encrypted transmission, two-factor authentication and continuous monitoring, to an AI assistant that can run on your own server.
Servers and data kept in data centres within the European Union, in line with GDPR requirements.
With every client we sign a data processing agreement that clearly defines the scope and responsibilities of each party.
By default the AI assistant uses a language model in the Groq service in the USA (under EU standard contractual clauses). On request it can run on your own server or on a private model hosted in the European Union — questions and documents then do not leave that environment. The processing location and the model provider are written into the data processing agreement.
The option to deploy on your infrastructure and a source-code licence — full control and no vendor lock-in (a clear exit scenario).
Infrastructure hosted in ISO 27001-certified data centres (OVHcloud) — the certification covers the provider's infrastructure.
All communication between app and server is encrypted with the latest HTTPS / TLS 1.3 standard.
Passwords are stored only as an irreversible hash, and two-factor authentication secrets are encrypted with AES-256. Server disk encryption is set up on request during deployment.
Traffic is forced onto HTTPS, plus protective headers — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — set up during deployment.
An extra layer of verification at login, protecting accounts from unauthorised access.
Login with a corporate account over OpenID Connect — through Microsoft Entra ID, for example.
The session token sits in the phone's system keystore and can be revoked instantly on the server — logging in on a new device ends the account's other sessions.
Role-based access to content — administrator, super-administrator, management per country and site.
A hardware key (a YubiKey, for example) can be added to an editor's or administrator's account - held against the phone or plugged into the computer. The administrator decides which actions require the key. Every use and every failed attempt is recorded in the history.
A firewall protecting the infrastructure; administrative access limited strictly to authorised people.
Servers report events to a SIEM-class system, and an alert about an unusual event reaches us immediately.
System security updates install automatically, and application updates go out in the night window — with a daily report.
External specialists have tested the application on behalf of corporate clients — most recently in 2025. We implemented the recommendations from that test and the client confirmed it. We are ready for a test commissioned by you.
The database is backed up automatically once a day; the copies are kept in the European Union.
Every week we automatically check dependencies, images and repositories for known vulnerabilities and accidentally committed secrets.
We check service availability automatically and outages report themselves — an alert reaches us within minutes. The guaranteed availability level and response times are set out in the contract.
We restore the service from the latest daily backup — the maximum data loss is 24 hours (RPO). The target recovery time is agreed in the SLA.
The app does not browse photos, contacts or messages on the phone — the employee chooses what to attach. Location is recorded only when they record a sports activity themselves.
A production worker logs in with their employee number — no company email needed. For people without a phone, a shop-floor screen shows the same content, with no login.
Phone number and private email are not required — we collect only the data necessary for the app to work.
In settings the employee decides which notifications they want — each category is switched off with a single toggle, and the change takes effect at once.
Comments can be moderated: a tab for pending ones, removal with a stated reason and a notice to the author, a profanity filter and the option to switch comments off under a single post.
When a collaboration ends we revoke access to servers and admin panels, and we review administrative accounts and keep them limited to named people.
Two-factor login is required of everyone on the team in the AllAbout code repository.
We maintain formal security and data protection documentation. Because of its confidential nature we share it after verification — leave your contact details and we'll get in touch and provide the selected documents.
Data protection rules, responsibilities, IT safeguards and incident handling. Available on request.
Rules for securely managing the IT system that processes personal data. Available on request.
An assessment of risks to data processed in the app, carried out under Art. 32 GDPR. Available on request.
Fulfilment of information obligations towards the people whose data we process. Available on request.
The team's commitment to keep entrusted data confidential. Available on request.
During a demo we'll show the technical details, architecture and data handling using your company as an example.
Let's talk
AllAbout