Skip to main content
Trust & Compliance

Data Handling & Storage

Where your data lives, how it is protected, how it is backed up, and what happens if something goes wrong. Precise and factual — no marketing language.

Storage specifications

Encryption in transit

HTTPS

Server location

United Kingdom

Backups

Automated

Secondary backup

Geographically separated

Where your data is stored

IBIOS runs on a dedicated VPS hosted in the United Kingdom. This is the primary storage location for customer records, job data, quotes, and system logs. Some AI processing currently uses US-based providers (Groq and OpenAI) under UK transfer safeguards — see our sub-processor list. Coming soon: UK-only AI processing on our own GPUs.

All connections between your browser or device and the IBIOS servers are encrypted in transit over HTTPS, so data cannot be read by anyone intercepting the connection.

The database is not directly accessible from the public internet. Access to the database is restricted to the application layer running on the same server, reducing the attack surface compared to exposed database endpoints.

Backup policy

Automated database backups run on a regular schedule, giving you a recovery window for accidental data loss or deletion. Old backups are securely deleted once they fall outside the retention period.

A secondary backup is maintained in a geographically separated location within the UK. This protects against data centre-level failure and ensures continuity even in the event of a serious incident at the primary location.

Backup restoration is tested periodically as part of our operational processes. If you need data restored from a backup — for example, following accidental deletion — contact support@allforone.ai with the details, and we will confirm the restoration timeline.

Access controls

IBIOS uses role-based permissions to control what each staff member can see and do. Sensitive capabilities — viewing cost prices, deleting records, managing users — are separate permissions assigned by an admin. Staff see only what their role grants them.

Authentication uses JWT (JSON Web Token) sessions that expire, after which staff must sign in again. Passwords are stored as one-way hashes and are never kept in plain text. Password resets require email verification to the registered address.

All actions that create, modify, or delete data are recorded in the audit log with the user ID, timestamp, IP address, and a description of the change. The audit log is read-only for all users except system administrators, and cannot be cleared by standard staff or manager roles.

AI data handling

IBIOS AI features such as Quote Studio and Ask IBIOS use third-party AI providers, including US-based Groq and OpenAI. Data transmitted to these providers is subject to their data processing agreements, which IBIOS has in place. Coming soon: the AI Receptionist, which will process call audio and generate transcripts, and UK-only AI processing on our own GPUs.

Importantly: data sent to our AI providers is not used to train their models without explicit consent. Our API usage agreements with all providers include this data protection provision. We do not opt in to any training data sharing on your behalf.

The AI layer has a restricted view of your ERP data. It can access customer names, calendar availability, and product information needed to answer questions. It does not have access to cost prices, profit margins, or commercially sensitive supplier data. This segregation is enforced at the application layer.

Incident response

In the event of a security incident or suspected data breach, IBIOS follows a structured response process:

  1. Incident detected and contained as quickly as possible.
  2. Scope and nature of affected data assessed.
  3. Affected customers notified within 72 hours where required under UK GDPR.
  4. Written incident report provided to affected customers on request.
  5. Remediation steps implemented and documented.

To report a suspected security issue, email security@allforone.ai. We take all reports seriously.

Which IBIOS features handle your data?

IBIOS (Integrated Business Intelligence & Operations System) is made by IBIOS Limited (NI743167), Northern Ireland. These pages cover the parts of IBIOS that store, protect and restore your business data.

What do customers ask about how IBIOS handles data?

Can staff see other staff members’ data?

Staff users can only see what their role permits. User account details (email, login history, permissions) are visible only to admin-level users. Standard staff roles do not have access to other users’ account information. All access is logged in the audit trail.

What happens if there is a data breach?

If IBIOS becomes aware of a personal data breach that is likely to result in a risk to individuals’ rights and freedoms, we will notify you within 72 hours of becoming aware, as required by UK GDPR. You, as data controller, are responsible for notifying the ICO and any affected individuals where required. We will provide all information needed to support your notification.

How do I export all my data?

Customer records, jobs, quotes, and products can be exported in CSV format from the IBIOS dashboard. Full account data exports can be requested by emailing privacy@allforone.ai. We will provide a complete data export covering all data we hold for your account including audit logs.

Will the AI Receptionist (coming soon) store call transcripts?

Coming soon: when the AI Receptionist launches, its call transcripts will be stored in your IBIOS account, linked to the relevant customer or lead record, accessible to authorised staff only, and subject to the same retention and erasure policies as other personal data in your account.

What about payment card data?

IBIOS does not store payment card data. Card payments are processed entirely by Stripe, which is PCI DSS Level 1 certified. IBIOS only stores the outcome of a payment transaction (paid/unpaid status, amount, date) and a Stripe reference. No card numbers, expiry dates, or CVV codes are ever transmitted to or stored on IBIOS servers.

Questions about data handling?

Contact us at privacy@allforone.ai for data handling and privacy questions, or security@allforone.ai for security reports. A member of the team will reply.