Security and data protection
Allbound AI processes B2B prospecting data on behalf of its clients. Here, transparently, is where that data is hosted, who has access to it and what commitments we make.
Where your data is hosted
The platform's database, authentication, storage and application execution are hosted in the European Union, in France (data centers located in Paris). Daily backups are retained for seven days, in the same region. Some technical processing (traffic delivery, transactional emails, artificial intelligence) is performed by providers located outside the European Union: every transfer is governed by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses (see the list of sub-processors below).
Who is responsible for what
You, the client
You are the data controller. You define your targets and your messages, the legal basis for your prospecting (in B2B, generally legitimate interest) and the information given to the people you contact, with a simple way for them to object to prospecting.
Allbound AI
We are a data processor within the meaning of Article 28 of the GDPR. We process data only according to your instructions, we help you respond to data subject requests and we delete or exclude a prospect on simple request.
The data processing agreement (DPA) is built into our license agreement (Article 11 and Appendix 1). It is available on request before signing.
Our commitments
No reselling
We do not sell, rent or transfer your data.
No data pooling
One client's data is never used for another client.
No AI training
Your data is not used to train artificial intelligence models.
Data breach
Notification within 48 hours at most.
Reversibility
Full export of your data in CSV format, then deletion within 30 days of the end of the contract.
Controlled retention
You can delete your data at any time; we recommend not keeping a prospect with no response for more than 3 years, in line with CNIL recommendations.
Security measures
- Data encryption in transit (TLS) and at rest
- Data segregation by client organization
- Named access accounts; credential sharing is prohibited
- Internal access limited to what is strictly necessary, with two-factor authentication on administration consoles
- API keys and secrets encrypted, kept out of the source code
- Automated daily backups
- Logging of access and technical events
- Incident management procedure
- Annual review of security measures and sub-processors
Our sub-processors
We work with a limited number of sub-processors, selected for their security guarantees. Each is bound by a data processing agreement, and any change is notified to our clients at least 30 days in advance. The nominative list of our sub-processors, with their location, is shared with our clients and prospects on simple request at hello@getallbound.ai.
| Category | Location | Transfer safeguards |
|---|---|---|
| Database hosting and backups | European Union (France) | Data stored in the EU |
| Application hosting and execution | European Union (France) | Data processed in the EU |
| Orchestration of automated tasks | United Kingdom | European Commission adequacy decision |
| Traffic delivery and security | Global network | EU–US Data Privacy Framework or standard contractual clauses |
| Transactional emails | United States | EU–US Data Privacy Framework or standard contractual clauses |
| Artificial intelligence (qualification, scoring, copywriting), only when the API key is provided by Allbound AI | United States | Standard contractual clauses |
| Collection of public professional data | Outside the European Union | Adequacy decision or standard contractual clauses |
| Platform development and maintenance | France | No transfer |
Database hosting and backups
- Location :
- European Union (France)
- Transfer safeguards :
- Data stored in the EU
Application hosting and execution
- Location :
- European Union (France)
- Transfer safeguards :
- Data processed in the EU
Orchestration of automated tasks
- Location :
- United Kingdom
- Transfer safeguards :
- European Commission adequacy decision
Traffic delivery and security
- Location :
- Global network
- Transfer safeguards :
- EU–US Data Privacy Framework or standard contractual clauses
Transactional emails
- Location :
- United States
- Transfer safeguards :
- EU–US Data Privacy Framework or standard contractual clauses
Artificial intelligence (qualification, scoring, copywriting), only when the API key is provided by Allbound AI
- Location :
- United States
- Transfer safeguards :
- Standard contractual clauses
Collection of public professional data
- Location :
- Outside the European Union
- Transfer safeguards :
- Adequacy decision or standard contractual clauses
Platform development and maintenance
- Location :
- France
- Transfer safeguards :
- No transfer
When you use your own AI API key, your own professional social network account or your own enrichment and CRM tools, those services fall under your direct relationship with their providers.
Responsible prospecting
The platform helps you prospect in compliance with the GDPR and CNIL recommendations for B2B prospecting: targeting based on professional role, professional data only (no sensitive data), deletion or exclusion of a prospect on request. It is your responsibility to inform the people you contact and to offer them a simple way to object to your messages.
Frequently asked questions
Allbound AI acts as a processor for its clients and governs this role through a DPA compliant with Article 28 of the GDPR, data hosted in France, listed sub-processors and documented security measures. Compliance of the prospecting itself also rests with the client, as data controller.
Yes, simply ask at hello@getallbound.ai.
No. Neither Allbound AI nor its sub-processors use your data to train models.
By contacting the client who reached out to them, or by writing to hello@getallbound.ai: we forward the request to the client and carry out the deletion or exclusion on their instruction.
Yes. It is shared on simple request at hello@getallbound.ai, with each sub-processor's location and the safeguards governing transfers.
Yes. Write to us and we will send you our documentation.
A question about security or GDPR?
Write to us at hello@getallbound.ai with « Personal data » in the subject line. We also answer your security questionnaires and send you our DPA.