Security

Security is built into Harborne AI from the ground up. This page summarises our technical and organisational measures. It complements our Privacy Policy and Data Processing Agreement.

1. Where your data is stored

Customer data - your database, sign-in accounts, uploaded files and backups - is stored on servers we run in the United Kingdom. Where any processing happens outside the UK/EU (for example a third-party AI provider), we rely on UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as described in our Privacy Policy.

2. Protecting stored data

The database itself can’t be reached from the internet. Data is only reached through our application and an API that requires an access key, and every account’s data is kept apart by row-level security (see section 5).

The most sensitive secrets - the access tokens for any third-party services you connect (such as your messaging channels and calendar) - are encrypted by the application with AES-256-GCM before they are written to the database, so they are never stored in readable form. Passwords are never stored at all, only a salted hash.

3. Encryption in transit

All connections to the Service are encrypted with TLS 1.2 or higher - the web app, the APIs, the real-time voice WebSocket and every call to our providers. We enforce HTTPS with HSTS, and modern security response headers: a Content Security Policy that limits which scripts can run in the app, no MIME sniffing, clickjacking protection and a strict referrer policy.

4. Personal data & data minimisation

Because Harborne AIis a receptionist/CRM, some personal data is intentionally identifiable - your customers’ names, emails, phone numbers, and the calls, messages and transcripts they exchange with your AI. We hold this on your behalf, under a lawful basis you control, so your AI can do its job. We minimise everything else: we don’t sell data, we keep only what the Service needs, operational logs are short-lived, and we don’t use your or your customers’ content to train third-party AI models. Sensitive special-category data should not be sent through the Service unless separately agreed (see the DPA).

5. Access controls

• Tenant isolation:every account’s data is protected by row-level security so users can only ever access their own data.
• Authentication: accounts are protected by secure sign-in, with optional two-factor authentication (2FA) using an authenticator app - we prompt you to enable it and you can turn it on at any time from your account settings. Passwords must be strong, and passwords known from public data breaches are refused.
• Staff access: our admin console requires two-factor authentication for every member of staff. Back-end access uses least-privilege, server-side credentials that are never exposed to the browser, and our servers accept key-based logins only, never passwords.
• Audit logging:security-sensitive actions on your account (such as data exports, password and 2FA changes, deletion requests and new integrations) are recorded to a tamper-resistant audit trail, which you can review under Settings → Security.
• Abuse protection: all web traffic passes through Cloudflare, which filters attacks before they reach us. Sign-up, sign-in and contact forms are protected by a bot check, public endpoints are rate-limited, repeated failed logins are blocked, and inbound webhooks are signature-verified, so the Service is protected against automated abuse, floods and forged requests.
• Hardened servers: a firewall closes everything except the web and secure-login ports, and security updates are installed automatically.
• Personnel: only a small number of authorised staff can access production systems, on a need-to-know basis, and provider access is logged.

6. Data retention

We don’t keep data forever. Records are automatically deleted once they pass their retention period:

• Conversations, recordings & transcripts: 12 months after creation by default, or 3 or 6 months if the account holder chooses a shorter period in Settings, or until you or your customer asks us to delete them sooner.
• Account & billing records: the life of your account, then up to 7 years for tax and accounting records.
• Operational logs: up to 90 days.

You or your customers can request earlier deletion at any time - see your Privacy Policy rights. You can also export a copy of your data and request account deletion yourself, directly from Settings → Privacy & data, without having to email us.

7. Service reliability

Production runs over HTTPS behind Cloudflare and our own reverse proxy. We monitor a health endpoint with external uptime checks, capture application errors with alerting on spikes, and watch our scheduled jobs with a heartbeat so a stalled scheduler is detected quickly. The database and uploaded files are backed up every night, and backups are kept for 14 days.

8. Breach response

We maintain a written incident-response process. If we become aware of a personal data breach, we will: contain and investigate it; assess the risk to individuals; and, where required, notify the ICO within 72 hours of becoming aware, and inform affected customers and individuals without undue delay. As our processor obligations require, we will give you the information you need to meet your own notification duties. Report a suspected issue to privacy@harborne.ai.

9. Subprocessors & third-party providers

We use vetted subprocessors to deliver the Service, each under a data processing agreement with appropriate safeguards. We do not permit AI providers to train their general models on your content.

We carry out due diligence on our providers and review their security posture and certifications (such as SOC 2 / ISO 27001) where available. For our current subprocessor list or copies of relevant documentation, contact dpo@harborne.ai.

Contact

Security questions or to report a vulnerability: privacy@harborne.ai.