Security & Data Protection
Last updated: October 2, 2026
InBoxIA is used by hair salons, clinics, shops, restaurants, schools and professionals across many different industries. Whatever your business, your data and the data of the people who message you get the same level of protection.
Encryption
Always in transit (HTTPS/TLS). At rest, with additional reinforced encryption for the most sensitive data.
EU-based infrastructure
Our own servers at Hetzner (Germany). We don't use a third-party managed database service.
Isolation between businesses
Each business only accesses its own data. No business ever sees another business's information.
Least privilege
Every integration (WhatsApp, Google, social media) only requests the permissions strictly necessary for the feature you use.
What InBoxIA encrypts
Passwords are encrypted with bcrypt and all communications travel over HTTPS/TLS. Access tokens for the integrations you connect (WhatsApp, Google, social media) are stored encrypted at rest.
For data that regulation treats as a special category — for example, clinical history for a healthcare business, or biometric data in the hospitality sector — we apply an additional, dedicated encryption layer for that data, independent of the rest of the platform. It's an example of how we handle the most sensitive data with extra care, not the only thing we protect: the same principle of "encrypt what needs it, with the key it needs" applies based on each data point's actual risk, whatever industry your business is in.
Where your data lives
Our servers run on Hetzner Online GmbH (Germany, European Union). The database is hosted on our own encrypted infrastructure; we don't delegate its management to a third-party database provider.
Isolation between businesses
Every business on InBoxIA operates in its own isolated space: conversations, contacts, appointments, billing and any other data stay separated by business. This applies across every layer of the platform, not just the interface.
Who we share data with
Only with the providers strictly necessary to run the platform (payment processing, conversational AI, integrations you voluntarily activate). The full list, with the reason for each, is in our Privacy Policy.
Special categories of data
If your business is in healthcare, wellness or a similar field and you process your customers' health data, that data receives the differentiated treatment required by Article 9 GDPR: a specific legal basis, explicit activation of the relevant module, and reinforced encryption. Full detail is in the Privacy Policy, and if you need paperwork for your own compliance, our Data Processing Agreement is publicly available.
Your rights
As with any personal data processing, you have the right to access, rectification, erasure, portability, objection and restriction. The procedure to exercise them is in the Privacy Policy.
Contact
If you have a security question or want to report a vulnerability, write to us at agent@inbox-ia.com.