Security

1. How Cohavo is hosted

• Your own server. Each customer has its own virtual server running the whole of Cohavo, and its own storage bucket for recordings, files and backups, with a storage key that reaches only that bucket.
• In London. Customer servers, storage, our console and our sign-in service run in DigitalOcean’s London data centre. Some suppliers process parts of the data elsewhere: see the table below and our Subprocessors page.
• Firewalled. Only the ports Cohavo needs are open. Administrative access to servers needs a key and comes only from our office’s fixed internet address.

2. Signing in

• Everyone who signs in with a password also uses a two-step code from an authenticator app.
• Businesses can switch on sign-in with Microsoft or Google instead.
• Repeated failed sign-ins are slowed and then blocked.
• Roles (owner, admin, team lead, agent) control who can see recordings, listen in, change settings and export data, and settings changes are kept in an audit log.

3. Encryption

• In transit: web and app traffic uses TLS 1.2 or later. Calls in the browser are encrypted, and so are calls on apps and desk phones set to use TLS; admins can require it for the apps.
• At rest: we encrypt the most sensitive secrets on each server (AI provider keys, two-step code secrets, sign-in secrets and Microsoft 365 connection tokens).

4. Our access

Only the people who run Cohavo can reach customer servers, and only to give support you ask for, fix incidents or keep the service secure. They sign in to a server with our private key, and only from our office’s fixed internet address. Our console, which runs every server, is open only to our office’s internet address and uses passkeys.

5. Backups and monitoring

• Each server’s database is backed up every night into its own storage bucket, and each backup is kept for 30 days.
• Our console checks every server around the clock and raises an alert if one goes offline, a service fails, a disk fills up, a backup is missed, the phone line drops or a certificate is about to expire.

6. AI and your data

We don’t use your data to train AI models. What each AI supplier keeps, and whether it may use data to improve its own models, is on our Subprocessors page. See also Recording and AI.

7. Certifications

We don’t hold any security certifications ourselves (such as Cyber Essentials, ISO 27001 or SOC 2). The companies we rely on hold their own, listed below. We answer security questionnaires on request: email support@cohavo.io.

8. Reporting a security problem

If you think you’ve found a security problem in Cohavo or this website, please email support@cohavo.io with “Security” in the subject, and don’t access other people’s data or disrupt the service while testing. We welcome reports made in good faith and will reply. Our security.txt has the same details.

9. The companies we rely on

Every accreditation below is as listed on the company’s own page, checked on the date shown. They’re the companies’ certifications, not ours.