Last updated: January 15, 2025
At Sotabox, security is not just a feature—it's fundamental to everything we build. We understand that you trust us with your most sensitive business information, and we take that responsibility seriously. This Security Policy outlines the measures we take to protect your data and maintain the integrity of our platform.
Sotabox is hosted on enterprise-grade cloud infrastructure provided by leading cloud service providers (AWS, Google Cloud) that maintain the following certifications:
Our infrastructure is protected by multiple layers of network security:
Our cloud providers maintain strict physical security controls including 24/7 security personnel, biometric access controls, video surveillance, and environmental controls to protect against physical threats.
All customer data stored in our systems is encrypted using AES-256 encryption, one of the strongest encryption standards available. This includes:
All data transmitted between your devices and our servers is protected using TLS 1.3 encryption. We enforce HTTPS for all connections and implement HTTP Strict Transport Security (HSTS) to prevent downgrade attacks.
Encryption keys are managed using industry-standard key management services with automatic key rotation. Customer encryption keys are stored separately from encrypted data and are never exposed in plaintext.
We implement robust authentication mechanisms to protect your account:
Access to data and features is controlled through role-based access control (RBAC):
Sotabox employees have strictly limited access to customer data:
Customer data is logically isolated to ensure that no customer can access another customer's data. We use separate database schemas and strict access controls to maintain data isolation.
We retain customer data only for as long as necessary to provide our services or as required by law. Upon account termination or request, customer data is securely deleted within 30 days, with complete purging from backups within 90 days.
We maintain regular automated backups of all customer data:
We do not use your data to train AI models. Your documents and content are processed solely to provide you with the requested services. AI processing is performed in isolated environments, and your data is not shared with or used to improve models for other customers.
Our development practices follow industry best practices:
We proactively identify and address security vulnerabilities:
We employ 24/7 monitoring to detect security incidents:
Our incident response team follows a documented process:
In the event of a security breach affecting customer data, we will:
Sotabox has achieved SOC 2 Type II certification, demonstrating our commitment to security, availability, processing integrity, confidentiality, and privacy. Our SOC 2 report is available to customers and prospects under NDA.
We comply with the General Data Protection Regulation (GDPR) for customers in the European Union, including:
We maintain compliance with applicable regulations and can support customers with specific compliance requirements, including CCPA, HIPAA (with BAA for Enterprise customers), and industry-specific regulations.
We maintain comprehensive disaster recovery capabilities:
We commit to 99.9% uptime for our services, with status updates available at our public status page. Enterprise customers may negotiate enhanced SLAs with dedicated support.
Enterprise Plus customers have access to additional security features:
We welcome responsible disclosure of security vulnerabilities. If you discover a security issue, please report it to:
Email: security@sotabox.com
PGP Key: Available upon request
We ask that you:
We commit to acknowledging receipt within 24 hours and providing regular updates on our progress.
For security-related questions or to request our SOC 2 report, please contact:
Email: security@sotabox.com
Address: 123 Innovation Drive, Suite 400, San Francisco, CA 94105
By submitting this form, you acknowledge and agree that Sotabox will process personal information in accordance with the Privacy Policy.