Enterprise-Grade Peace of Mind

• Hosted on SOC 2 and ISO 27001 compliant cloud infrastructure (Google Cloud Platform)
• Data encrypted in transit using TLS 1.3 and at rest using AES-256
• Isolated environments for production, staging, and development
• Continuous monitoring and alerting for suspicious activity

• Role-based access control (RBAC) across platform and internal tools
• Least-privilege access enforced for all employees
• Multi-factor authentication (MFA) for internal systems
• Audit logs for access to sensitive systems and data

Bubba's AI is powerful, and carefully constrained.

• AI actions are governed by explicit permissions and workflows
• No autonomous actions without customer-defined rules
• Human-override and approval mechanisms available for critical operations
• Full traceability of AI-initiated actions (calls, negotiations, bookings)
• Customer data is strictly isolated and never used to train, fine-tune, or improve third-party AI models
• Zero-data-retention agreements and contractual commitments with foundational LLM providers

Automation without guardrails is risk. Bubba ships with guardrails.

• Strict tenant isolation, with no shared data pools
• Logical separation of customer environments
• Secure APIs with authentication, authorization, and rate limiting
• Regular testing for cross-tenant access vulnerabilities

If something ever goes wrong, we act fast and communicate clearly.

• Documented incident response plan
• Dedicated on-call escalation for security events
• Customer notification protocols aligned with regulatory requirements
• Post-incident reviews and remediation tracking

We design our product so carriers don't have to opt into privacy. It's already there.

• Data minimization: we collect only what's required to deliver value
• Purpose limitation: data is used only for the feature it supports
• Configurable permissions across teams and roles
• Support for customer-driven compliance requirements

• Deployed within private Virtual Private Clouds (VPCs)
• Controlled NAT gateways restrict outbound traffic
• No direct public access to internal services
• API access secured and authenticated

• Company-issued devices only for production access
• Device encryption and enforced security policies
• Centralized access control and compliance monitoring
• Remote lock and wipe capabilities

• Hosted on Google Cloud
• Enterprise-grade physical data center security
• Built-in redundancy and fault tolerance
• Continuous infrastructure monitoring

• Data processing aligned with GDPR principles
• Purpose limitation and data minimization by design
• Support for applicable data subject rights requests
• Secure handling of EU personal data

Yes. Hey Bubba! is SOC 2 Type I and Type II compliant. We have successfully completed both independent audits. Our Type II examination covers Security, Confidentiality, and Availability and verifies that our security controls operate effectively over the audit period.

• SOC 2 Type I and Type II audits completed
• Security, Confidentiality, and Availability controls independently audited
• Continuous monitoring and testing maintain our audited controls
• SOC 2 Type II report available upon request under NDA

Yes. Hey Bubba! holds an accredited ISO/IEC 27001:2022 certification for our Information Security Management System (ISMS). This standard verifies our organizational risk management, cloud infrastructure security, product development lifecycle, and continuous improvement processes.

• Accredited ISO/IEC 27001:2022 certification for our ISMS
• Certificate publicly available
• Documented controls for security and governance
• Ongoing internal audits and compliance reviews

No. Customer data processed through Hey Bubba! is strictly isolated. We maintain zero-data-retention agreements and contractual commitments with our foundational LLM providers, ensuring your operational and dispatch data is never used to train, fine-tune, or improve third-party models.

Hey Bubba! is SOC 2 Type I and Type II compliant and ISO/IEC 27001:2022 certified. Our SOC 2 audits independently evaluate our security controls, with the Type II report covering their operation over the audit period. The Type II report is available upon request under NDA. Our ISO 27001 certificate covers our Information Security Management System (ISMS) and is publicly available.

All customer data is encrypted in transit using TLS 1.3 and at rest using AES-256 within SOC 2 and ISO 27001 compliant cloud infrastructure (Google Cloud Platform).

• 24/7/365 engineering on-call coverage
• Defined incident response and escalation procedures
• Real-time monitoring and alerting
• Rapid containment and remediation processes