Trust
Trust and security
Last updated 18 September 2026. This is the early-access version. The full document will replace it before general availability, and we will notify every workspace owner when it does.
Four things uBumi never does
✕Train on your data
Your Brain, mail, transcripts, and outputs are never used to train models, ours or anyone's. Model providers process uBumi traffic under API terms that exclude training.
✕Act outside your rules
Email and messages to outsiders, money, and deletion wait for a person unless you allow them. The blog and the phone line run on settings you control, and you can switch either to approval.
✕Share across workspaces
Every query is scoped to the workspace a person belongs to. There is no cross-workspace access, not even for the same owner.
✕See your card
Payments run at Stripe. Card numbers never touch uBumi's servers.
Where we stand
We would rather tell you what is true than print a badge. This table is kept current.
| Standard | Status | Detail |
|---|---|---|
| Encryption | In place | TLS 1.2+ in transit. AES-256 at rest for the database and files. OAuth tokens and connection credentials are additionally sealed with AES-256-GCM under a key held only by the application. |
| Google API Services User Data Policy | Verified | Limited Use: Google data is used only for the features you switch on, never for advertising, never sold, never used to train models. Google verified uBumi on 16 September 2026 for calendar access (calendar.events), which is the only Google permission we ask for; your mail is reached through your own mailbox, not through Google. |
| PCI DSS | Via Stripe | Stripe, a PCI Level 1 provider, collects and stores all payment details. |
| PIPEDA and GDPR | Aligned practices | Data minimisation, purpose limitation, access and deletion on request, sub-processor transparency. A data processing agreement is available on request. Formal EU representation is not yet in place. |
| SOC 2 | Not yet | No audit has been performed. We plan a Type I attestation once the product leaves early access, and we will not claim it until an independent auditor has issued it. |
| ISO 27001 | Not planned this year | Controls below follow the standard's spirit; certification is not scheduled. |
Approval rules you control
Before an email or message goes to someone outside the company, uBumi shows exactly what will be sent, to whom, and why, and waits. Owners decide which action types may run on their own, per employee, per tool, with an allowlist of domains links may point to and a list of prices that may be quoted.
The team works internally. Nothing is sent to your clients without you: emails, texts, social posts, and meeting recaps for attendees wait for your approval or for a setting you switch on. Two things run on their own, because asking every time would defeat the purpose: Pendo publishes the articles you planned to your website on the schedule you agreed (switch this off to approve each one), and the phone line answers and books calls from people who ring in, inside your hours.
New workspaces run in shadow mode for two weeks, where outgoing email and publishing are held even if a policy allows them.
AI safety
Untrusted content stays data. Email bodies, web pages, transcripts, and documents are treated as information, never as instructions. A run that has read outside content is marked, and stricter rules apply to what it may do next. A caller or a sender cannot change an employee's rules.
A second model checks the first. Outbound text passes a validator for banned phrases, prices outside the approved list, links outside your allowlist, and promises the company did not make.
Meetings are transcribed, not recorded. Amina announces herself when she joins, keeps only the text, and sends the recap to you; the other attendees get it only when you press send. When she is allowed to answer by name, she answers only from your Brain and never quotes an unapproved price.
The phone line follows the same rules. The receptionist takes messages and books only inside your hours and only on a calendar you connected; anything about contracts, complaints, legal, tax, or medical matters is escalated to a person.
Access and isolation
Sign-in is passwordless: Google, or a one-time code by email. Every request is checked against the person's workspace memberships on the server; the browser never holds a database credential. Roles are owner, manager, and member, and only owners see billing or can delete a workspace. Each connected tool asks for the narrowest permission the job needs, and disconnecting revokes the token at the provider and deletes it from uBumi.
Audit
Every proposal, decision, approval, execution, sign-in, invite, and setting change is written to an append-only audit log per workspace, with who did what and when. Owners can read it on the Activity page at any time.
Deletion
Owners delete conversations, Brain entries, drafts, and whole workspaces themselves, from the app, at once. Deleting a workspace cancels its subscription and removes its data; the phone number stays on the account as a spare. Account deletion is completed within 7 business days of a request to support@ubumiai.com. Backups roll off within 30 days.
Sub-processors
- Supabase (AWS, Oregon, US)Database, file storage, authentication
- Vercel (US)Application hosting and edge network
- Anthropic (US)Language models: the reasoning behind each employee, and the validator that checks outbound text before it is shown to you. Processed under API terms that exclude training
- OpenAI (US)Language models, transcription, image generation, text-to-speech, through the API with every optional data-sharing setting switched off, so customer data is not used for training
- Retell (US)Phone calls Amina answers and places: call handling, transcripts, and recordings. Their copy is deleted after 90 days; uBumi keeps the transcript and summary. Contractually barred from training on call data, and the model and voice providers behind it are held to zero data retention
- Recall.ai (US)Meeting attendance: live transcription; audio and video are not retained, transcripts are deleted from their side after 48 hours
- Twilio (US)Text and WhatsApp messages: appointment confirmations and reminders for workspaces that switch texting on, and the WhatsApp channel your team uses to reach their employees from a phone
- Stripe (US)Subscriptions, invoices, and cards
- Web Hosting Canada (Canada)Email to and from your workspace's uBumi address, including noreply@ubumiai.com
- Google (US)Gmail and Calendar, only for workspaces that connect a Google account
- Slack (US)Messages in the channels you invite the team into, only for workspaces that connect Slack
- Microsoft (US)Mail and calendar, only for workspaces that connect a Microsoft account
- LinkedIn (US)Posts Pendo publishes, only for workspaces that connect LinkedIn
- Meta (US)Posts published to a Facebook Page, only for workspaces that connect one
- Webflow (US)Articles published to your website, only for workspaces that connect Webflow
Data is hosted in the United States, with one exception: email is processed in Canada, by Web Hosting Canada. The tools in the second half of the list receive nothing until a workspace connects them. Owners are notified by email before a sub-processor is added.
Responsible disclosure
Found a vulnerability? Write to support@ubumiai.com with the subject “Security”. We acknowledge within two business days, keep you informed, and credit you if you wish. Please do not access other customers' data or run automated scans against production.
Questions people ask
Can uBumi staff read my mail? No. Access to production data is limited to the founder for support and incident response, and every such access is logged.
Do model providers keep my data? They process it to produce a response and, under API terms, may retain it briefly for abuse monitoring; they do not train on it.
Can I get a DPA or a security questionnaire answered? Yes, on request to support@ubumiai.com. We answer questionnaires within a week.