Security
How we work with store feedback.
Access, encryption, AI, and the GDPR rules that apply to a store using Bolb.
Last updated: October 2026
How we work with data
Access follows the store
Owners, managers, and staff have different permissions. Server and database checks apply store, role, and department boundaries to protected operations.
Sensitive fields are encrypted before storage
Full transcript text and supported integration tokens, including Gmail and Microsoft refresh tokens, are encrypted by the application with AES-256-GCM before they are written to the database.
Recordings are not left open
Playback requires an authenticated, authorised request and then uses a short-lived signed URL. Application traffic uses HTTPS.
Redaction runs before follow-up
Public feedback is redacted before downstream follow-up generation. Redaction reduces exposure but does not guarantee anonymisation.
Voice has a shorter active life
New processing does not persist text-bearing segment metadata. Older recordings may still contain plaintext segments. Audio is scheduled for removal from active storage 30 days after upload.
GDPR
We comply with the GDPR
For feedback a store collects, the store is the controller and Bolb is the processor once a data processing agreement is accepted. Bolb is responsible for its own accounts, invitations, and the customer relationship. This page describes that work. It is not a certification.
How we use AI
What the models are used for
Bolb uses AI to transcribe audio, mask personal details, analyse feedback, and help staff follow up.
Customer feedback is not training data
Bolb does not train its own models on customer feedback. Feedback is not used to train the models that process it.
Questions from your security team?
The sub-processor list and Bolb's data processing terms are available on request. We can confirm which supplier agreements cover the service. We do not forward suppliers' own contracts.
security@bolb.ioHow Bolb handles information about its own customers is described in the privacy notice. To report a vulnerability, use the same address.