Security & Compliance

UK-hosted. Data Processing Terms published. No compromises.

IBIOS is built for UK businesses that hold customer data, process payments, and record phone calls. Security and compliance are not add-ons — they are built into the platform from the infrastructure upwards.

Data Processing Terms published. Production hosted in the UK. No card data stored. Role-based access on every account.

IBIOS is made by IBIOS Limited (NI743167), Northern Ireland. Some AI processing uses US providers (Groq and OpenAI), as listed on the sub-processors page; UK-only AI processing is coming soon.

Join the waiting list Request the DPA

UK-hosted

Production hosted in the United Kingdom

Card data

No card numbers stored in IBIOS

GDPR

DPA available to all customers

How does IBIOS keep business data secure?

Every item below describes a concrete technical or organisational measure that is active on every IBIOS account, unless marked coming soon — not available as a premium add-on.

UK hosting

The IBIOS production system, database and file storage are hosted in the UK. Some AI processing uses providers outside the UK, under UK transfer safeguards — see /legal/subprocessors.

Data Processing Terms

Our Data Processing Terms and sub-processor list are published at /legal/dpa and /legal/subprocessors, and apply to all customers.

Card payments kept out of IBIOS

No card numbers stored in IBIOS. Card payments run through Stripe or SumUp by pay by link, so customers enter card details on the provider’s page.

Role-based access control

Permission flags covering cost visibility, quote approval, user management, supplier management, deletion, and audit access. Each user role is configured by an administrator.

JWT authentication

Session tokens expire, and are invalidated on logout. If a device is lost, an administrator can revoke active sessions for any user account.

bcrypt password hashing

Passwords are hashed with bcrypt before storage. Plain-text passwords are never stored. Password reset requires email verification to a confirmed address.

Encrypted in transit

Data in transit between your browser and IBIOS servers is encrypted. HTTPS is enforced; HTTP connections are redirected.

Backups

The database is backed up, and backup data is stored separately from primary data.

Who can see cost prices and margins in IBIOS?

Every IBIOS user account is assigned a role with specific permission flags. Permissions can be configured by an administrator and adjusted at any time. Staff see only what they need to see to do their job. Access rights can be set per role or per person, and brand separation keeps each brand’s records apart.

can_view_costs

See trade cost prices and gross margin on quotes and jobs

can_view_profits

See profit analysis and margin reporting across the business

can_approve_quotes

Approve quotes before they are sent to customers

can_manage_suppliers

Create, edit, and delete supplier records and product links

can_manage_users

Create, edit, and deactivate user accounts and roles

can_delete_records

Delete customer, job, quote, and order records

can_view_audit

Access the full audit log of system activity

What do people ask about IBIOS security and UK GDPR?

Where is my data stored?

IBIOS production — the database and file storage holding customer records, job records, quotes, and documents — is hosted on servers located in the United Kingdom. Some AI processing, such as call transcription and document OCR, uses sub-processors outside the UK, including US providers, as listed at /legal/subprocessors. UK-only AI processing is coming soon.

Is IBIOS GDPR compliant?

IBIOS is designed to support your UK GDPR obligations. A Data Processing Agreement covering our obligations as a data processor is available to all customers on request. Customers can request a copy of their data or deletion of their account at any time. Automated data retention schedules allow you to set deletion timelines for call recordings and other personal data held in the system.

How does IBIOS handle card payments and PCI DSS?

IBIOS does not store payment card data anywhere in the system. Card payments are processed by Stripe or SumUp; staff send the customer a pay by link and the customer pays on the provider’s page. IBIOS does not record calls and has no feature that stops or restarts a call recording, so do not take card details on a recorded call; ask your phone provider how it keeps card details out of its recordings.

Can I export my data?

Yes. You can ask for a full export of your data. Customer records, job records, quotes and supplier orders can be exported in CSV and JSON formats.

Does IBIOS have a data processing agreement?

Yes. A Data Processing Agreement is available to all IBIOS customers, covering our obligations as a data processor under UK GDPR. The DPA describes the categories of personal data we process, the purposes for which we process it, the technical and organisational measures we apply, and the sub-processors we use. Contact the IBIOS team to request the DPA at any time.

UK-hosted. No compromises on compliance.

Data Processing Terms published at /legal/dpa. Talk to us about your compliance needs.