Security

Security measures

Hosting and network

• Hosted on AWS in the London region.
• Application containers accept no inbound connections. Cloudflare reaches the application only through an encrypted tunnel that the application opens outbound to Cloudflare. Cloudflare provides DDoS protection in front of it.
• The database isn’t publicly accessible, and accepts connections only from the application.

Encryption

• In transit:
  • HTTPS only from the internet to Cloudflare, then an encrypted tunnel (TLS) from Cloudflare to the application;
  • HSTS on the app;
  • the attachment store refuses unencrypted requests;
  • the database connection requires TLS.
• At rest: database storage, backups and attachment storage are encrypted with AWS-managed keys. Application secrets are held in AWS SSM Parameter Store as encrypted values. A credential the customer gives Robovue to reach its own systems, such as an Automation Anywhere API key, is also encrypted by the application before it’s stored, and so are the address of each alert channel (a Slack or Microsoft Teams webhook URL, or an outgoing webhook’s address) and an outgoing webhook’s authorisation header and signing secret. So are the workspace’s own credentials: its API keys, webhook secret and Management API key.

Access control

• Customers sign in through AWS Cognito. Passwords must meet a minimum length, with upper-case, lower-case and numeric characters. Each person can add an authenticator app as a second step.
• A signed-in session ends after 7 days at most, and each person can sign out of every session at once.
• Every request is scoped to the signed-in user’s workspace, so one workspace can’t read another’s data.
• Bots authenticate with either a per-workspace API key or a request signed with HMAC-SHA256 and a 5-minute replay window. Both are checked in constant time.
• Keys can be rotated from the dashboard, with an overlap period so bots keep working while they switch over.
• Access to infrastructure uses least-privilege IAM roles. The application connects to the database with its own role, not the administrator’s.
• Deployments to AWS run from CI with short-lived credentials, so there are no long-lived AWS deploy keys. The Cloudflare settings and the website are deployed with Cloudflare API tokens, held as encrypted CI secrets.

Resilience

• Automated daily database backups, kept for 7 days. A restore from backup is tested automatically every month.
• Uptime is monitored by an external service, with a public status page.

Application

• Every response carries a Content Security Policy, frame denial, no-sniff, a referrer policy and a permissions policy.
• The app loads no third-party scripts, apart from the one Cloudflare adds to every page to detect automated traffic, which is served from Robovue’s own domain.
• Ingestion, the management API, attachment uploads and feedback are rate limited.
• Outgoing webhooks are signed, so the receiver can check that each one came from Robovue.

How long data is kept, and how it’s deleted

• During the subscription:
  • run history is deleted once it’s older than the plan’s retention window: 30 days on Free, 90 days on Team, and no limit on Business. When a plan with a shorter window takes over, such as after a downgrade or a trial, history beyond the new window is kept for 14 more days;
  • attachments are deleted after 30 days, or sooner if the customer chooses 7 or 14 days;
  • delivery-log entries are deleted after 7 days at most.
• A workspace Admin can permanently delete a single run, with its attachment, or a whole bot, with all its runs and attachments.
• Deleting the workspace removes all Customer Data from the live service immediately. An Admin can do this themselves.
• Whatever is deleted leaves the live service at once, and backups within 7 days.

If something goes wrong

Robovue will notify the customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Data. The notice will describe what is known at the time:

• the nature of the breach;
• its likely consequences;
• the measures taken.

Robovue will update the notice as it learns more.

Reporting a security issue

If you think you’ve found a vulnerability in Robovue, email security@robovue.co.uk, and please do not test it against other customers’ data. The same address covers the .NET and Python SDKs. Our build pipeline publishes them through each registry’s trusted publishing, so no publishing key is stored anywhere. Where your data is stored, and who else processes it, is on the subprocessors page.

Last updated: 2026-10-29.