Snapshot 49697
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Trust & security Security and trust, by design. Garba joins the sales calls you configure it to join, and turns them into structured notes, CRM updates and follow-ups. Your data is in our care — and we take that seriously. Here’s exactly how. Request [email protected] Hosting EU by default Primary processing in Sweden on Microsoft Azure. Standard GDPR aligned DPA incorporated into every customer contract. Certification SOC 2 in progress Audit underway. Model training Never on your data No cross-customer training. Committed in our Terms. Breach notice 48 hours Notification to affected customers of a confirmed breach. Overview Our approach to trust. Garba AI AB is a Swedish company headquartered in Malmö, building a B2B sales intelligence platform for European sales teams. The product captures, transcribes and analyses sales conversations — which means we’re entrusted with some of our customers’ most sensitive commercial data. Security and GDPR compliance are treated as product requirements, not afterthoughts. Customer data stays in the EU by default. When processing leaves the EU, it’s governed by Standard Contractual Clauses and DPF certifications. This page is the canonical source of information for prospects, customers and security reviewers. For anything not covered here, email [email protected]. Compliance Independently governed. Compliant GDPR Garba processes personal data in accordance with the EU GDPR. Our DPA is incorporated by reference into every customer contract via our standard terms. A counter-signed copy is available on request. Default EU data residency All primary processing infrastructure is hosted in the EU on Microsoft Azure (Sweden). AI inference is performed on EU-hosted infrastructure, using a combination of AWS, Google Cloud, and Microsoft Azure regions within the EU. Via sub-processors DPF (Data Privacy Framework) Where transfers to the US are necessary, they are covered by SCCs and/or DPF certification of the sub-processor. In progress SOC 2 We are currently working towards SOC 2 certification, with the audit underway. Our security programme is built on the technical and organisational measures detailed in our DPA. Security controls How we protect your data. The controls below are implemented across our production environment and reviewed regularly. Pulled from the technical and organisational measures of our DPA. Encryption in transit TLS (current versions) for all data in transit. Encryption at rest AES-256 symmetric encryption for stored data. Key management Encryption keys are managed securely with access restricted to authorised personnel. Access control Principle of least privilege with role-based access control (RBAC). Access reviewed, granted and revoked through a formal process. Multi-factor authentication MFA required for access to production environments and any system handling personal data. Security monitoring Continuous monitoring via Microsoft Defender for Cloud (CSPM), audit log analysis and automated alerts. Application & vulnerability management Enforced HTTPS, input validation and OWASP Top 10 protection, with dependency scanning via GitHub Dependabot and automated security checks in CI/CD. Logging & traceability All access and changes logged with user identity and timestamps. Logs are reviewed regularly. Backups & recovery Regular automated backups with redundant cloud storage, reproducible CI/CD deployments, 48-hour recovery objective. Incident management Documented incident response plan; 48-hour breach notification to customers. Secure SDLC Pull request reviews, automated security scanning, agentic code review for every change. Sub-processor governance Written agreements with every sub-processor imposing equivalent obligations to our DPA. Data deletion On termination: customer data available for export or return within 30 days; full deletion within 3 months; backups expire per rotation schedule. Business continuity Documented business continuity procedures cover adverse operational events. Recovery processes are tested periodically to verify they remain effective. Audit rights Customers may audit our compliance with the DPA. Audits are primarily remote, once per 12-month period, with 30 days' written notice. Third-party certifications and reports may satisfy audit requirements. Full terms in DPA §8. How we use your data You own what you put in. You own your data You retain all rights in the data you put into Garba: recordings, transcripts, CRM data, meeting metadata, and all AI-generated outputs (summaries, insights, analyses). This is committed in our Terms. No cross-customer model training We do not use your data to train, improve or develop AI models for the benefit of other customers. Where we use aggregated, anonymised data to improve the Service itself, no individual or company can be identified from it. No automated decisions with legal effects Garba does not make automated decisions that produce legal or similarly significant effects on individuals under GDPR Article 22. AI outputs are decision-support, not decisions. Email ingestion With customer configuration, Garba ingests and analyses email communications from connected email accounts (Gmail, Microsoft 365/Outlook). Customers control which emails are ingested through filter rules. Email content and metadata are retained per the customer's configured retention period and deleted within 3 months of account termination. MCP server & third-party AI assistants Customers may authorise third-party AI assistants (e.g. Claude, ChatGPT) to query Garba data via our Model Context Protocol (MCP) server. Access is scoped by the customer's access controls and limited to authorised users. Customers control which assistants are authorised. AI-generated outputs may contain inaccuracies. Customers are responsible for reviewing outputs before acting on them. This is a shared-responsibility model: Garba provides the infrastructure and the model access; the customer exercises judgment on the output. Sub-processors The vendors we use, and why. Garba provides customers with 30 days’ notice of new or replacement sub-processors. Subscribe below to be notified when this list changes. Sub-processor Purpose Location Transfer mechanism Microsoft Azure (Ireland) Hosting, cloud infrastructure, Azure OpenAI for AI processing Sweden (Gävle) — EU EU only Recall.ai (Hyperdoc Inc, US) Meeting bot & recording for Google Meet, Zoom, Teams Germany (primary); limited ad-hoc US support access SCCs (EU 2021/914) Gladia SAS (France) Speech-to-text transcription France — EU EU only Amazon Web Services EMEA SARL (Luxembourg) AI analysis and summarisation (LLMs) via AWS Bedrock EU (AWS Bedrock EU inference profile; processing stays within the EU) SCCs Module 3 + DPF Google Cloud EMEA Limited (Ireland) AI analysis and summarisation via Google Vertex AI (LLM inference) Belgium (St. Ghislain) — EU SCCs Module 3 + DPF Mailjet / Sinch (France) Transactional email (meeting reminders, opt-outs) Germany & Belgium — EU EU only Stripe Payments Europe (Ireland) Card payment processing Primary processing in Ireland — EU; transfers to Stripe LLC (US) for affiliate processing SCCs + DPF Gleap GmbH (Austria) In-app customer support & feedback Germany — EU EU only Okta / Auth0 (US) Identity, SSO, MFA EU (AWS Frankfurt/Ireland) primary; limited US for support SCCs + DPF Data residency EU by default. Default location: EU/EEA All primary processing infrastructure is hosted in the EU on Microsoft Azure (Sweden). AI inference is performed on EU-hosted infrastructure, using a combination of AWS, Google Cloud, and Microsoft Azure regions within the EU. Transfers outside the EEA No routine transfers outside the EEA for primary data. Limited ad-hoc support access by US sub-processors is governed by SCCs (EU 2021/914) and DPF certifications. Standard Contractual Clauses Where transfers are necessary, we use the 2021/914 SCCs as the primary transfer mechanism, with supplementary measures applied. No model training on your data Customer data is not used to train third-party foundation models. Our agreements with Azure OpenAI, AWS Bedrock, Google Vertex AI and Gladia explicitly prohibit such use. Privacy & GDPR How we treat personal data. What data we process Names, job titles and email addresses; video and audio recordings, transcripts and uploaded video files; meeting metadata; email content and metadata from connected inboxes; AI-generated analytic outputs linked to identified individuals; and authentication and activity data (user IDs, IP addresses, device metadata). Full categories are detailed in Appendix 1.1, Section 3 of our DPA. Email ingestion from customer inboxes With customer configuration, Garba ingests and analyses email communications from connected accounts (Gmail, Microsoft 365 / Outlook). Customers control which emails are ingested through filter rules. Email content and metadata follow the customer’s configured retention period and are deleted within 3 months of account termination. Data subject rights We respond to data subject requests within statutory timelines. Email [email protected] to exercise your rights. Retention By default, customer data (including audio recordings, transcripts and email content) is not deleted automatically — customers configure their own retention rules in the product.Meeting metadata: retained for the term of the agreement.Audit logs: 12 months for system/access logs, 3 years for audit logs.Backups: retained per rotation schedule (7 days to 3 years).All customer data is deleted within 3 months of account termination. Response times for data subject requests We respond to data subject requests within one month of receipt. For complex or high-volume requests, the response window may be extended by up to two additional months with written notice, as permitted under GDPR Article 12(3). Special-category data We do not intentionally process special-category (Article 9) personal data. Because meeting recordings and transcripts may incidentally capture such data, we apply technical and organisational measures appropriate to that risk, including encryption, access controls, and confidentiality obligations. Documents Reports & agreements. Data Processing Agreement (DPA) Incorporated by reference into every customer contract via our standard terms. Request access for a counter-signed PDF (link expires after 7 days). Privacy Policy How we collect, use and protect personal data. Request access and we'll send you the latest version. Terms & Conditions Standard terms governing use of the Garba platform. Request access and we'll send you the latest version. TAC Security Test Independent third-party security/penetration test report. Request access and we'll share the latest version (link expires after 7 days). AI Addendum Garba's AI policy addendum covering AI processing, sub-processors, and customer commitments. Request access and we'll send you the latest version. Incident response If something goes wrong. 48h Notification to affected customers of a confirmed personal data breach. 72h Notification to the Swedish supervisory authority (IMY) of a reportable breach, where required. Response plan We maintain a documented incident response plan covering detection, containment, eradication, recovery and post-incident review. Plans are tested and updated regularly. How customers are notified Email to the registered security contact, plus in-app notifications. Updates continue until the incident is closed. Communication channel [email protected] for all incident-related communication. Post-incident reports Detailed post-incident reports made available to affected customers, including root cause and remediation steps. FAQ Frequently asked questions. Contact Talk to us. Get in touch For any question — security, privacy, procurement, InfoSec questionnaires, vulnerability reports, or anything not covered on this page — email us. 90-day coordinated disclosure for vulnerabilities; we won’t pursue legal action against good-faith researchers. [email protected] Supervisory authority Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) — the competent supervisory authority for Garba AI AB. www.imy.se Trust, verifiable Security you can verify, not just take our word for. Every claim on this page maps to a control, a contract clause, or a sub-processor commitment. Ask us for the receipt. Request documentsEmail the team