Your data and security

oboloo’s Trust Center.

Your organisation’s data and security is our top priority. oboloo uses a range of technologies to keep your data safe — including hosting within ISO 27001 certified data centres.

Live security status Microsoft SSO Multi-factor auth Cloudflare protected Encrypted & SSL 5,000+ simulated attacks every month
12Annual vulnerability scans
99.5%Guaranteed uptime
5,000+Monthly simulated attacks
24hData backed up every
Excellent
CriticalExcellent
Live security status Web application penetration test
Assessed. Verified. No critical vulnerabilities.

This certificate confirms that oboloo has been independently assessed for vulnerabilities by Beagle Security. Click the badge to view the live report.

Last tested18 October 2026
SeverityNo critical vulnerabilities found
Assessed byBeagle Security
Independently verified
Certified byBeagle Security →
Built in

Security, built in.

Security isn’t an add-on — it’s built into everything, from login to data storage and infrastructure.

Microsoft logo
Microsoft SSO

Secure sign in via Microsoft single sign-on

Find out more
AWS logo
AWS document storage

Dedicated, secure storage for your documents

Find out more
Database icon
Your isolated database

Ensuring that your data can never come into contact with another customer’s

Find out more
Cloud backup icon
Backed up every 24-hours

We back up your data every day, giving you peace of mind

Find out more
AI features

Your data stays yours when AI is involved.

AI features in oboloo summarise and assist — they never make the decision. Your data is never used to train a model, your users’ existing permissions always apply, and administrators can switch AI off by user role.

  • Never used for training
  • Your permissions always apply
  • Deleted by our providers within 30 days
  • Switch off by user role
How we use AI
Access control

Who is signed in, and what they can see.

Session control, device alerts and record-level permissions — all managed by your own administrators, without raising a ticket.

Active sessions MacBook Pro · this device London, UK iPhone 15 London, UK Windows PC Manchester, UK Sign out Signed out on 1 device AUTO SIGN-OUT when idle New sign-in detected Email sent to the account owner Not you? Sign out everywhere

Every one of these controls lives in Settings → Security, on every plan.

Every session, visible

See each device signed in to your account under Security, with its location, and sign any of them out.

Signs itself out

Inactive sessions end automatically, so an unattended screen does not stay open without someone there.

Change a password, clear every device

Changing a password immediately ends every other session on the account.

Told when a new device signs in

A notification email goes out as soon as an account is accessed from a device it has not seen before.

Told when an API key is created

Creating an API key triggers a security email, so a key can never be issued quietly.

Your admins, not our support desk

Administrators reset any user's password and change the account's primary user themselves.

Access set record by record

Record owners restrict who can see a supplier, contract or saving, down to the individual record.

Permissions reach the AI too

AI features answer only from records the person asking is already allowed to see. No role is bypassed.

Always on

Live certificates & scanners.

Independent security testing and live system monitoring — all visible, all the time.

Microsoft logo
Single sign-on

With Microsoft SSO, users can securely access oboloo using their existing organisation’s Microsoft credentials, reducing the need for multiple passwords and minimising the risk of unauthorised access.

Database icon
Isolated database

Every company that uses oboloo has their own database. This ensures that two different companies’ data never comes in touch with each other and is completely isolated.

OBOLOO Your database Isolated Another client Isolated
AWS logo
AWS S3 storage

AWS S3 storage ensures the security and reliability of your files. AWS S3 offers top-tier durability, availability, and performance. This guarantees your data is protected and accessible at all times.

Cloud backup icon
24-hour daily backups

We back up your company’s data every 24 hours no matter what plan you are on. This will give your business peace of mind in case the worst ever did happen.

Policies

Core policies.

Policies that affect customers’ use of the oboloo platform. Internal oboloo company policies can be found further down.

Governance

Internal oboloo policies.

Aligned with ISO/IEC 27001 controls, these are the policies oboloo uses as an organisation to ensure customer data integrity and employee cyber security. Partly redacted for public use.

Key information

No matter what plan you are on, all companies enjoy the below robust security features that come as standard with oboloo

Got a question?
  • Microsoft Single Sign-On (SSO)
  • Mitigating attacks with Cloudflare®
  • AWS S3 document storage
  • Dedicated subdomain
  • Isolated database per company
  • Multi-factor authentication (MFA)
  • Backed up every 24 hours
  • State-of-the-art encryption
  • Secure socket layer (SSL)