Security

Security measures

Hosting and network

• Hosted on AWS in the London region.
• Application containers run in private subnets and have no public address.
• The database isn’t publicly accessible, and accepts connections only from the application.
• The load balancer accepts only HTTPS, and only from Cloudflare’s network. Cloudflare provides DDoS protection in front of it.

Encryption

• In transit:
  • HTTPS only from the internet to Cloudflare, then TLS 1.2 or higher from Cloudflare to the load balancer;
  • HSTS on the app;
  • the attachment store refuses unencrypted requests;
  • the database connection requires TLS.
• At rest: database storage, backups and attachment storage are encrypted with AWS-managed keys. Application secrets are held in AWS SSM Parameter Store as encrypted values. A credential the customer gives Robovue to reach its own systems, such as an Automation Anywhere API key, is also encrypted by the application before it’s stored.

Access control

• Customers sign in through AWS Cognito. Passwords must be at least 8 characters, with upper-case, lower-case and numeric characters.
• Every request is scoped to the signed-in user’s workspace, so one workspace can’t read another’s data.
• Bots authenticate with either a per-workspace API key or a request signed with HMAC-SHA256 and a 5-minute replay window. Both are checked in constant time.
• Keys can be rotated from the dashboard, with an overlap period so bots keep working while they switch over.
• Access to infrastructure uses least-privilege IAM roles.
• Deployments run from CI with short-lived credentials. There are no long-lived deploy keys.

Resilience

• Automated daily database backups, kept for 7 days. Restores are tested.
• Uptime is monitored by an external service, with a public status page.

Application

• Every response carries a Content Security Policy, frame denial, no-sniff, a referrer policy and a permissions policy.
• The app loads no third-party scripts.
• Ingestion, the management API, attachment uploads and feedback are rate limited.

How long data is kept, and how it’s deleted

• During the subscription:
  • run history is deleted once it’s older than the plan’s retention window: 30 days on Free, 90 days on Team, and no limit on Business;
  • attachments are deleted after 30 days, or sooner if the customer chooses 7 or 14 days;
  • delivery-log entries are deleted after 7 days at most.
• A workspace Admin can permanently delete a single run, with its attachment, or a whole bot, with all its runs and attachments.
• Deleting the workspace removes all Customer Data from the live service immediately. An Admin can do this themselves.
• Whatever is deleted leaves the live service at once, and backups within 7 days.

If something goes wrong

Robovue will notify the customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Data. The notice will describe what is known at the time:

• the nature of the breach;
• its likely consequences;
• the measures taken.

Robovue will update the notice as it learns more.

Reporting a security issue

If you think you’ve found a vulnerability in Robovue, email contact@robovue.co.uk with “Security” in the subject, and please don’t test it against other customers’ data. The same address covers the .NET and Python SDKs, which are published from our build pipeline through each registry’s trusted publishing, so no publishing key is stored anywhere. Where your data is stored, and who else processes it, is on the subprocessors page.

Last updated: 2026-10-15.