Skip to content
Request a demo

Security

What protects your documents, as it is built today.

This page describes controls the product has and that tests check. Servabo holds no security certification yet (no SOC 2 or ISO 27001 report), and an independent penetration test is planned before the first enterprise contract. We will add either only when there is a report to show you.

Tenant isolation

Every plan
  • Every organization's documents, fields, conversations and settings are separated by organization and workspace on every query; the server resolves who you are, which organization you are in and what your role allows on every request.
  • Tests that replay the API's operations with another organization's identifiers, as a person and as an API key, run on every change to the code.
  • A workspace you have no grant in answers "not found": its existence is not revealed.

Roles and permissions

Every plan
  • Organization roles: owner, admin, billing and member. Workspace roles: admin, contributor and viewer. Nobody can give a role above their own, and the last owner cannot leave.
  • Plan changes and payment methods are the owner's; seats can be bought by owners, admins and billing managers after the price is shown.
  • API keys carry only the scopes you give them and work only in the organization that issued them.

Audit log

Every plan
  • Sign-in policy changes, role changes, exports, deletions, key creation and other sensitive actions are recorded with who, what and when.
  • The database itself refuses to change or delete an audit entry. You choose how long the log is kept (at least 400 days) and can export it.

Encryption

Every plan
  • Traffic to the app is HTTPS only, with HSTS. The app is served under a strict Content-Security-Policy that allows no inline script and no framing.
  • Secrets you give Servabo (mail server passwords, ERP and warehouse credentials, your own AI keys, single sign-on certificates) are encrypted at rest with keys that can be rotated; a rotation re-encrypts every secret column.
  • API keys and directory tokens are stored only as keyed hashes. Passwords are hashed with Argon2.
  • Database backups are encrypted before they leave the server.

Sign-in policies

Every plan
  • Time-based two-factor authentication with recovery codes, and an organization switch that requires it for everyone.
  • Session lifetimes, sign-in lockout and backoff after repeated failures; sign-in and password reset answer the same way whether or not an address exists.
  • Every emailed link (verification, reset, invitation) is single-use, expires, and carries its token where it is never sent to a server log.

Single sign-on and SCIM

Enterprise only
  • SAML 2.0 and OpenID Connect with any standard identity provider, on a domain you verify with a DNS record.
  • Require single sign-on for your organization; SCIM provisioning adds and removes people from your directory, within your seats.

Where your data may go

Enterprise only
  • Egress lockdown confines every connection made for your organization (webhooks, warehouses, ERP, mail, AI providers) to destinations you allow, and records every refusal.
  • Every destination a customer can configure is refused if it points at a private, loopback or cloud-metadata address.

Where data is stored

Servabo runs on Hetzner Cloud in Germany (EU). Your documents and their pages, redacted copies and profile pictures, and the database with extracted text, fields, the search index, members, settings and the audit log are stored there, with uploaded files and encrypted backups in object storage (subprocessors).

The organization setting called data residency decides where two things are written: compliance export archives and your organization's branding files (logo and favicon). It does not move your documents. Real residency for documents means a separate regional deployment of the whole service, database included; there is none yet, and the setting's screen says exactly what it covers.

Report a vulnerability

Write to [email protected] with "Security report" in the subject, what you found and how to reproduce it. We reply within two business days, fix confirmed issues as a priority, and will not take action against good-faith research that avoids other customers' data and does not disrupt the service.