Security and data

The data belongs
to the organisation.
We only process it.

pibiCo acts as data processor. The contracting organisation is the controller, and that decides who says what is kept, what is exported and what is destroyed. It is in the agreement, not on a marketing page.

EUhosting inside the European Union

TLSencryption in transit, and encryption at rest

DPAdata processing agreement signed with each organisation

0data sold or disclosed to third parties

AI-generated image: a symmetrical corridor of brushed steel filing cabinets lit by cold light strips. — Isolation per organisation Image generated with AI

Each organisation, its own enclosure

One organisation's data never shares logical space with another's. Every query carries the organisation identity attached, and a request without it returns nothing rather than returning too much.

Inside each organisation, separation by scope applies as well. The only thing shared is the record the organisation needs: minutes, signatures and actions.

Identity

Identity comes from the organisation

Access supports a password, a single-use code sent to the corporate email address, or a device-bound passkey. Organisations with stricter requirements disable the password and operate with passkeys only, which never travel and cannot be phished by email.

Those that need it connect their own directory over SSO (OIDC, SAML or OAuth2): joining and leaving pibiCollab follow joining and leaving the corporate system.

GDPR

Rights that are actually exercised

Who is controller and who is processor?

The contracting organisation is the data controller. pibiCo acts as processor and handles the data on its documented instructions, under the data processing agreement signed alongside the contract.

How are access, rectification and erasure requests handled?

They are addressed to the contracting organisation, which is the controller. pibiCo provides the export and deletion tooling it needs in the administration panel to answer them within the statutory deadline.

Is the data used to train AI models?

No. Neither the organisation's content nor the users' scopes are used to train or fine-tune models, our own or third parties'. Where an external model provider is involved, it is under a processing contract that expressly forbids reuse.

Can the organisation take everything with it if it leaves?

Yes. Full export in open formats is part of the contract, as is the subsequent destruction deadline. There is no portability penalty and no closed formats designed to keep anyone in.

Workplace monitoring

What this tool is not for

pibiCollab is not an employee monitoring system and is not built to be one. It does not measure active time, log keystrokes, capture screens or produce individual productivity reports.

Administrators see credit consumption per seat, which is commercial information from the contract, and the shared record they take part in themselves. Nothing else. That is not a promise of good behaviour: the data for anything else is simply not collected.

pibiCollab is a corporate tool and is not sold to consumers. The service is contracted under a written agreement with the organisation, which enrols its members and employees by invitation. Neither the website nor the mobile apps create accounts, display amounts, or allow anyone to purchase or extend the service.

Next step

Do you have data requirements to meet?

Tell us before anything is signed. If we cannot meet them, we say so in the first conversation.