Data Processing Agreement

This agreement forms part of the Terms of Service between Robovue’s operator, named in those terms (“Robovue”, the processor), and the customer (the controller). It covers personal data in Customer Data that Robovue processes for the customer, and it meets Article 28 of the UK GDPR.

1. Details of the processing

• Subject matter: monitoring the customer’s automation bots.
• Duration: the subscription, plus the deletion periods in section 9.
• Nature and purpose: receiving, storing and displaying bot run reports; sending alerts; and reporting.
• Data subjects: whoever appears in the customer’s run data. That’s usually the customer’s staff, and may include the customer’s own customers or suppliers if a bot handles their records.
• Categories of data: whatever the customer’s bots send. This includes:
  • bot and machine names;
  • run status and times;
  • error messages;
  • free-form payloads, up to 64 KB per report;
  • if the customer turns them on, one screenshot or text file per failed run, up to 5 MB;
  • raw event data from connected platforms (UiPath webhook events and Automation Anywhere activity records), which can include robot and user names.
• Special-category data: none intended. The Terms of Service don’t allow it to be sent.

2. Robovue’s obligations

Robovue will:

• process personal data only on the customer’s documented instructions. Those instructions are these terms, plus how the customer uses and configures the service. The exception is where the law requires otherwise; then Robovue will tell the customer first, unless the law forbids that;
• make sure everyone authorised to process the data is bound by confidentiality;
• apply the security measures in Annex A;
• use subprocessors only as section 7 allows;
• help the customer respond to data subject requests, as far as the nature of the processing allows. In the dashboard the customer can view and export run data, and delete it themselves: a single run, a run’s attachment, a bot with all its runs, or the whole workspace;
• help the customer with security, breach notification, data protection impact assessments and consultation with the ICO, as far as they relate to this processing;
• delete or return the data at the end of the service, as section 9 describes;
• make available the information needed to show it complies with this agreement, and allow audits under section 8.

Robovue will tell the customer promptly if it believes an instruction breaks data protection law.

3. The customer’s obligations

The customer is responsible for:

• having a lawful basis for the personal data its bots send;
• giving its data subjects any notice they need;
• not sending data the Terms of Service prohibit.

Screenshot attachments are off by default, and turning them on is the customer’s decision.

4. Personal data breaches

Robovue will notify the customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Data. The notice will describe what is known at the time:

• the nature of the breach;
• its likely consequences;
• the measures taken.

Robovue will update the notice as it learns more.

5. International transfers

Customer Data is stored in the UK, in AWS’s London region (eu-west-2). If a subprocessor processes it outside the UK, Robovue will make sure the transfer is protected by UK adequacy regulations or by appropriate safeguards under the UK GDPR.

6. Confidentiality

Robovue treats Customer Data as confidential. It accesses Customer Data only to provide the service, to support the customer at the customer’s request, or to investigate a security issue or a failure.

7. Subprocessors

• The customer gives general authorisation for the subprocessors listed on our subprocessors page.
• Robovue will give at least 30 days’ notice before adding a new one, by updating that page and emailing workspace Admins.
• If the customer objects on reasonable data protection grounds and we can’t resolve it together, the customer may cancel and get a refund of prepaid fees for the unused period.
• Robovue requires each subprocessor to agree to data protection terms at least as protective as these, and remains responsible for their work.
• The services the customer connects to receive its alerts (a Slack channel, a Microsoft Teams channel or chat, or an outgoing webhook’s endpoint) aren’t subprocessors. Robovue sends alerts to them on the customer’s instructions, and the customer’s own terms with each provider apply.

8. Audits

Robovue will answer reasonable written security questionnaires once a year and share the relevant documentation. If that isn’t enough to show compliance, or a regulator requires it, the customer may carry out an audit, no more than once a year, on these conditions:

• at least 30 days’ notice;
• at the customer’s own cost;
• during business hours;
• under confidentiality.

9. Deletion

• During the subscription:
  • run history is deleted once it’s older than the plan’s retention window: 30 days on Free, 90 days on Team, and no limit on Business. When a plan with a shorter window takes over, such as after a downgrade or a trial, history beyond the new window is kept for 14 more days;
  • attachments are deleted after 30 days, or sooner if the customer chooses 7 or 14 days;
  • delivery-log entries are deleted after 7 days at most.
• A workspace Admin can permanently delete a single run, with its attachment, or a whole bot, with all its runs and attachments.
• Deleting the workspace removes all Customer Data from the live service immediately. An Admin can do this themselves.
• Whatever is deleted leaves the live service at once, and backups within 7 days.

Annex A: Security measures

Hosting and network

• Hosted on AWS in the London region.
• Application containers accept no inbound connections. Cloudflare reaches the application only through an encrypted tunnel that the application opens outbound to Cloudflare. Cloudflare provides DDoS protection in front of it.
• The database isn’t publicly accessible, and accepts connections only from the application.

Encryption

• In transit:
  • HTTPS only from the internet to Cloudflare, then an encrypted tunnel (TLS) from Cloudflare to the application;
  • HSTS on the app;
  • the attachment store refuses unencrypted requests;
  • the database connection requires TLS.
• At rest: database storage, backups and attachment storage are encrypted with AWS-managed keys. Application secrets are held in AWS SSM Parameter Store as encrypted values. A credential the customer gives Robovue to reach its own systems, such as an Automation Anywhere API key, is also encrypted by the application before it’s stored, and so are the address of each alert channel (a Slack or Microsoft Teams webhook URL, or an outgoing webhook’s address) and an outgoing webhook’s authorisation header and signing secret. So are the workspace’s own credentials: its API keys, webhook secret and Management API key.

Access control

• Customers sign in through AWS Cognito. Passwords must meet a minimum length, with upper-case, lower-case and numeric characters. Each person can add an authenticator app as a second step.
• A signed-in session ends after 7 days at most, and each person can sign out of every session at once.
• Every request is scoped to the signed-in user’s workspace, so one workspace can’t read another’s data.
• Bots authenticate with either a per-workspace API key or a request signed with HMAC-SHA256 and a 5-minute replay window. Both are checked in constant time.
• Keys can be rotated from the dashboard, with an overlap period so bots keep working while they switch over.
• Access to infrastructure uses least-privilege IAM roles. The application connects to the database with its own role, not the administrator’s.
• Deployments to AWS run from CI with short-lived credentials, so there are no long-lived AWS deploy keys. The Cloudflare settings and the website are deployed with Cloudflare API tokens, held as encrypted CI secrets.

Resilience

• Automated daily database backups, kept for 7 days. A restore from backup is tested automatically every month.
• Uptime is monitored by an external service, with a public status page.

Application

• Every response carries a Content Security Policy, frame denial, no-sniff, a referrer policy and a permissions policy.
• The app loads no third-party scripts, apart from the one Cloudflare adds to every page to detect automated traffic, which is served from Robovue’s own domain.
• Ingestion, the management API, attachment uploads and feedback are rate limited.
• Outgoing webhooks are signed, so the receiver can check that each one came from Robovue.

Last updated: 2026-10-29.