Trust & security

How we handle your data.

Last updated: 10 June 2026

JOBBIE answers your inbound maintenance calls, captures the job, and prepares the WhatsApp handoff, which means we process call audio, transcripts, customer contact details, and your approved-subcontractor roster. This page lays out exactly who touches that data, what they do with it, and how you stay in control. If you need anything below in a procurement-friendly format (DPA, SOC 2 attestation roadmap, signed sub-processor list), email hello@tryjobbie.com and we'll send it.

The four trust promises

UK GDPR-aligned
Data controller is [Company legal name], registered in England & Wales (Companies House [Co. number]). ICO registration: [ICO ref].
No training on your calls
Call audio + transcripts are processed under zero-data-retention agreements with our model providers. Your firm's data is never used to train a public model.
Human-in-the-loop
JOBBIE prepares the handoff. You approve every dispatch. No auto-assignment, no "agentic" behaviour past the approval gate.
Full audit trail
Every call, transcript, shortlist, override and handoff is time-stamped and retained for the life of the engagement, exportable on request.

Sub-processors

Where your data is processed, by whom, and why. We commit to giving you 30 days' notice before we add, remove, or change a sub-processor. Email hello@tryjobbie.com to subscribe to that change list.

Provider	Purpose	Data category	Hosting region
Vercel	Website hosting + serverless functions (callback form)	Form submissions, request metadata, cookieless analytics	EU edge primary, US fallback
Resend	Transactional email delivery (lead enquiry → your inbox)	Lead name, firm, phone, trade, volume	US (EU residency on request)
[Telephony provider] (confirmed at signup)	Inbound call routing, recording, transcript hand-off	Call audio, caller phone number, call metadata	UK / EU
[Speech-to-text provider] (confirmed at signup)	Live transcription of inbound calls	Call audio (transient), transcript text	EU region under zero-retention agreement
[LLM provider] (confirmed at signup)	Conversational understanding, job extraction, summarisation	Transcript text + structured job payload	EU / US under zero-data-retention agreement
WhatsApp Business API (optional, per customer)	Handoff message to your approved subcontractor	Job summary, customer first name + postcode	Meta global infrastructure

Data Processing Agreement (DPA)

We sign a DPA before you sign with us, not after. The template names the controller (you), the processor (us), our purposes, our sub-processors (the table above), the categories of data, the retention windows, your audit rights, and the standard contractual clauses for any extra-UK transfer. Email hello@tryjobbie.com and we'll send a PDF in under 24h.

What we keep, and for how long

Call audio recordings: retained for the contract term + 30 days, then permanently deleted. Earlier deletion on written request.
Transcripts + structured job records: retained for the contract term + 30 days (audit trail), then permanently deleted.
Customer contact details captured on a call: held by JOBBIE only long enough to complete the handoff to your office / subcontractor; the long-term record lives in your systems, not ours.
Callback enquiry form: retained only as long as needed to respond and manage the business relationship.
Logs (operational): minimised by design; we log presence flags + redacted phone tails, not full PII. See Privacy for the full schema.

Where data is physically processed

JOBBIE's web tier (Vercel) is UK/EU-edge primary. Email delivery (Resend) and several model providers operate from the US under Standard Contractual Clauses (SCCs) and the UK IDTA addendum. Where a sub-processor offers EU residency we use it by default; where a US route is unavoidable (e.g. some LLM regions) we operate under SCCs + zero-data-retention. The Sub-processors table above names the current region per provider; we update it before any change.

Security controls

Encryption in transit: TLS 1.2+ on every endpoint, HSTS preloaded.
Encryption at rest: provider-managed AES-256 across hosting + storage.
Access controls: least-privilege role-based access to production; MFA mandatory for staff with production access.
Audit logging: every dispatch decision, override, and configuration change time-stamped and retained.
Vulnerability management: automated dependency scanning + 30-day patch SLA on critical CVEs.
Backups: daily encrypted snapshots of operational data with 30-day retention.

What we don't claim (yet)

On the roadmap, not in place today: We're early-stage. SOC 2 Type II and ISO 27001 are on our 12-month roadmap, not current attestations. We don't claim them. If your procurement gate requires either today, talk to us before you sign. We can usually agree a security questionnaire + contractual representations in their place.

How to report a security concern

Email security@tryjobbie.com with as much detail as you can share. We aim to acknowledge within 1 working day and provide a remediation update within 5. Coordinated disclosure preferred.

Your rights under UK GDPR

Access, correction, erasure, restriction, objection, portability. Email hello@tryjobbie.com to exercise any of them. You also have the right to complain to the ICO at ico.org.uk.