Security | How Collabix protects your data

In one paragraph

Collabix runs on Microsoft Azure with per-customer isolation. Data can be processed on EU or US Azure infrastructure; the exact production region for your environment is confirmed in writing in the data processing agreement. Azure OpenAI data is not used for model training. Encryption in transit and at rest. We are not yet SOC 2 or ISO 27001 certified.

What Collabix can see

Only what you connect, at the scope you set, per space and per goal. A folder you do not connect is a folder Collabix has no access to. Connector tokens are deleted the moment you disconnect a tool.

What it can change

Nothing, until somebody approves it. Every write to Jira or any other tool carries the decision it came from and the name of the person who approved it. A discarded item can be brought back; nothing is written silently.

How it is built

IsolationEach organisation in its own dedicated Azure resource group, storage, key store and AI resources.

EncryptionTLS in transit, encrypted database transport, Azure platform encryption at rest (AES-256), on by default.

AIAzure OpenAI inside Microsoft's environment. Prompts, meeting content and outputs are not used to train any Microsoft, OpenAI or third-party model and never reach OpenAI's consumer services.

AccessSingle sign-on through Google or Microsoft. Role-based access, default deny. MFA on administrator access.

SecretsAzure Key Vault with RBAC, soft-delete and purge protection. Credential-less federated identity for deployments. No secrets in source control or images.

Your rightsRight to erasure and data export through an administrator and the public API. Closing an organisation tears down its cloud resources.

Meetings

Collabix joins Google Meet, Microsoft Teams and Zoom as a visible, signed-in participant, the same way a person does. It cannot record without people seeing it in the call. Consent, and how you announce it, are yours to set.

What we are honest about

We are not SOC 2 or ISO 27001 certified. Azure holds those certifications at the infrastructure level; that is not the same as Collabix being certified. Readiness work is on the roadmap.
Our Google integration is not yet a Google-verified app; users see Google's unverified-app notice when they connect it.
Card payments are switched off; invoices are sent by email.
Sub-processors today: Microsoft Azure (hosting and AI), Recall.ai (meeting capture), Gladia (live transcription), Stripe (billing), a transactional email provider; on the website also HubSpot and Cal.com. The current list with regions, and the DPA, are available on request.

Reporting a vulnerability

Write to info@collabix.ai with what you found and how to reproduce it. We answer within two working days, keep you informed, and do not take legal action against good-faith research that stays within the law and does not touch other customers' data. Our security.txt says the same.

The name «Collabix» in phishing emails

A phishing campaign uses our name and fake sponsorship offers aimed at content creators. It is not us. Read the notice for what to check and how to report it.

Where your data runs, and what we are not certified for.