The IBIOS Trust Centre.
Everything you need to know about how we handle your data and keep your business secure.
UK hosting
The IBIOS production application, database and file storage are hosted on UK servers. Some AI processing currently uses US-based providers (Groq and OpenAI) under UK transfer safeguards, as listed on our sub-processor page.
Coming soon: UK-only AI processing on our own GPUs, so AI requests no longer leave the UK.
Server location
United Kingdom
Provider
UK data centre
AI processing
Some US providers — UK-only coming soon
GDPR compliance
A Data Processing Agreement is available on request — email hello@allforone.ai.
IBIOS uses Plausible Analytics for website analytics. Plausible is a privacy-first, cookie-free tool — it does not use cookies, does not track individual users, and does not collect personal data. This means IBIOS does not require a cookie consent banner on the marketing site.
Data Processing Agreement available on request
Plausible Analytics — no cookies, no personal data collection
Lawful basis for processing: contract performance and legitimate interest
PCI DSS and card payments
IBIOS does not store card numbers at any point. All card transactions are handled by Stripe and SumUp — both are PCI DSS Level 1 certified.
IBIOS does not record calls and does not stop or restart recordings during a payment. To keep card details off the phone, staff send the customer a pay by link, so the customer enters their card details on the payment provider’s page. If you take card details by phone, ask your phone provider how it keeps them out of its recordings.
Card numbers stored by IBIOS
Never
Card payments by phone
Pay by link, sent by staff
Stripe PCI DSS
Level 1 certified
SumUp PCI DSS
Level 1 certified
Access control and permissions
IBIOS uses JWT authentication with sessions that expire, and passwords are stored as one-way hashes. Access is controlled by role-based permissions: Admin, Manager, Sales, and Installer roles each have a defined permission set. Users can only access what their role permits.
Every action in IBIOS is recorded in a full audit log — who did what, when, from which IP address, on which record. The audit log is append-only and searchable by action type, entity type, user, and date range.
JWT authentication with sessions that expire
Passwords stored as one-way hashes, never in plain text
Role-based permissions (Admin, Manager, Sales, Installer)
Full audit log: every action, every user, IP address, timestamp
Cost and profit data gated behind specific role permissions
Infrastructure and deployment
Production infrastructure runs on a dedicated VPS in the United Kingdom. All traffic is encrypted in transit over HTTPS.
The database is backed up automatically and backups are encrypted. Uptime is monitored continuously with automated alerts. Deployment follows a safety workflow: changes are staged and reviewed before promotion to production.
Database backups
Automatic and encrypted
Data in transit
Encrypted over HTTPS
Uptime monitoring
Continuous, automated alerts
Deployment workflow
Staged — review before production
Responsible disclosure
If you believe you have found a security issue in IBIOS, please report it to us privately before making it public. We take all security reports seriously and respond promptly.
Contact
security@allforone.aiWhich IBIOS features support security and data protection?
IBIOS (Integrated Business Intelligence & Operations System) is made by IBIOS Limited (NI743167), Northern Ireland. These product pages explain the controls described above in more detail.
- User roles and access rights: access set per role and per person, so each team member sees only what they need.
- Backup and restore: how IBIOS backs up and restores your business data.
- Customers (CRM): the customer record your personal data obligations apply to.
- AI audit trail (coming soon): a record of every decision the planned AI receptionist makes.
What do people ask about IBIOS security and compliance?
Where is my data stored?
IBIOS production (application, database and file storage) is hosted on UK servers. Some AI processing currently uses US-based providers (Groq and OpenAI) under UK transfer safeguards — see our sub-processor list at /legal/subprocessors. Coming soon: UK-only AI processing on our own GPUs.
Is IBIOS GDPR compliant?
Our Data Processing Terms are published at /legal/dpa — email hello@allforone.ai for a signed copy. The lawful basis for processing your business data is contract performance and legitimate interest. Plausible Analytics is used for website analytics; it does not use cookies and does not collect personal data.
Does IBIOS have ISO 27001 certification?
No. IBIOS does not hold ISO 27001 certification, Cyber Essentials or SOC 2. Our security practices are built to ISO 27001-style controls (not certified). For current security documentation, please contact hello@allforone.ai.
How does IBIOS handle card payments taken by phone?
IBIOS does not take card details on calls and has no feature that stops or restarts a call recording. Staff send the customer a pay by link, and the payment is handled by Stripe or SumUp, both of which are PCI DSS Level 1 certified. IBIOS does not store card numbers at any point.
Can I get a Data Processing Agreement?
Yes. A Data Processing Agreement (DPA) is available on request. Email hello@allforone.ai with your business name and we will send it to you.
Questions about how we handle your data?
Email hello@allforone.ai and a member of the team will reply.