Enterprise-Grade Peace of Mind

• Hosted on SOC 2 and ISO 27001 compliant cloud infrastructure (Google Cloud Platform)
• Data encrypted in transit using TLS 1.3 and at rest using AES-256
• Isolated environments for production, staging, and development
• Continuous monitoring and alerting for suspicious activity

• Role-based access control (RBAC) across platform and internal tools
• Least-privilege access enforced for all employees
• Multi-factor authentication (MFA) for internal systems
• Audit logs for access to sensitive systems and data

Bubba's AI is powerful, and carefully constrained.

• AI actions are governed by explicit permissions and workflows
• No autonomous actions without customer-defined rules
• Human-override and approval mechanisms available for critical operations
• Full traceability of AI-initiated actions (calls, negotiations, bookings)
• Customer data is strictly isolated and never used to train, fine-tune, or improve third-party AI models
• Zero-data-retention agreements and contractual commitments with foundational LLM providers

Automation without guardrails is risk. Bubba ships with guardrails.

• Strict tenant isolation, with no shared data pools
• Logical separation of customer environments
• Secure APIs with authentication, authorization, and rate limiting
• Regular testing for cross-tenant access vulnerabilities

If something ever goes wrong, we act fast and communicate clearly.

• Documented incident response plan
• Dedicated on-call escalation for security events
• Customer notification protocols aligned with regulatory requirements
• Post-incident reviews and remediation tracking

We design our product so carriers don't have to opt into privacy. It's already there.

• Data minimization: we collect only what's required to deliver value
• Purpose limitation: data is used only for the feature it supports
• Configurable permissions across teams and roles
• Support for customer-driven compliance requirements

• Deployed within private Virtual Private Clouds (VPCs)
• Controlled NAT gateways restrict outbound traffic
• No direct public access to internal services
• API access secured and authenticated

• Company-issued devices only for production access
• Device encryption and enforced security policies
• Centralized access control and compliance monitoring
• Remote lock and wipe capabilities

• Hosted on Google Cloud
• Enterprise-grade physical data center security
• Built-in redundancy and fault tolerance
• Continuous infrastructure monitoring

• Data processing aligned with GDPR principles
• Purpose limitation and data minimization by design
• Support for applicable data subject rights requests
• Secure handling of EU personal data

Technically, SOC 2 is an independent auditor's attestation report, not a certification. Hey Bubba! has successfully completed a SOC 2 Type II examination covering Security, Confidentiality, and Availability. This verifies that our security controls operate effectively over an extended, continuous monitoring period.

• Controls aligned with SOC 2 Trust Services Criteria
• Independent third-party Type II examination completed
• Ongoing control testing and documentation
• SOC 2 Type II report available upon request under NDA

Yes. Hey Bubba! holds an accredited ISO/IEC 27001:2022 certification for our Information Security Management System (ISMS). This standard verifies our organizational risk management, cloud infrastructure security, product development lifecycle, and continuous improvement processes.

• Accredited ISO/IEC 27001:2022 certification for our ISMS
• Certificate publicly available
• Documented controls for security and governance
• Ongoing internal audits and compliance reviews

No. Customer data processed through Hey Bubba! is strictly isolated. We maintain zero-data-retention agreements and contractual commitments with our foundational LLM providers, ensuring your operational and dispatch data is never used to train, fine-tune, or improve third-party models.

ISO 27001 is an international standard certifying our overall Information Security Management System (ISMS), and our certificate is publicly available. SOC 2 Type II is an independent auditor's report evaluating the operational performance of specific security controls over time, which is available upon request under NDA.

All customer data is encrypted in transit using TLS 1.3 and at rest using AES-256 within SOC 2 and ISO 27001 compliant cloud infrastructure (Google Cloud Platform).

• 24/7/365 engineering on-call coverage
• Defined incident response and escalation procedures
• Real-time monitoring and alerting
• Rapid containment and remediation processes