Hosting, privacy and security controls.
Obliwise is hosted on Amazon Web Services in any region you choose. The Trust Centre shows how AI is used and which providers handle your data. Privacy requests, erasure and legal holds are handled in the product.
Works on its ownTrust, privacy and security works on its own, so if it is all you need it is all you buy, and every other part of Obliwise stays optional.
What trust, privacy and security includes
Everything below comes with it, ready on the first day and yours to change. 24 capabilities
Choose your hosting region
Your data is hosted in the AWS region you choose, anywhere AWS operates, and stays there.
Trust Centre
One page shows where your data lives, how AI is used, who processes it and your agreements.
Health information locked down
Health information is kept apart, encrypted under its own keys and every access is logged.
People's own data
People download their own data and ask for erasure themselves.
Keep everything in your country
One switch keeps every connection, including SMS, email and AI, inside your country.
AI on your terms
You choose which jobs AI may do, and can switch it off entirely.
AI kept in region
AI requests are refused if they would leave your region.
Personal details removed before AI
Personal details are taken out before text is sent to an AI model.
Emergency access
Urgent access to health information is allowed with a stated reason and reviewed afterwards.
Encryption with managed keys
Data is encrypted in transit and at rest with keys held in each region.
Write-once evidence
Evidence is stored in write-once storage and signed so it cannot be altered.
Privacy notice
You publish your privacy notice and every user acknowledges the current version.
Sub-processors
You see every sub-processor, get notice of new ones and can object.
Data processing agreement
Your data processing agreement is generated from your actual setup and signed online.
Health information in data requests
Data requests include health information for authorised requesters.
Erasure
Personal data is erased or pseudonymised on request, with a dry run first and audit records kept.
Legal holds
Records under a legal hold are protected from erasure and disposal.
Retention and disposal
Retention rules decide when records are reviewed and disposed of, with sign-off before anything goes.
Data breach register
Data breaches are logged with the regulator deadline counted down and escalated.
Accessible to everyone
Every screen meets WCAG 2.2 AA.
Security documentation
Security testing, controls and evidence are documented for your questionnaire and SOC 2 review.
Public status page
A public page shows whether the service is up.
Whole workspace erasure
At the end of a contract your whole workspace is erased after export, with a dry run first and an audit record kept.
Dedicated hosting
Your workspace runs on its own dedicated database or cluster.
Where it works
In the browser on any computer, and in these places too.
On the phone
In the iOS and Android apps, with or without signal.
- Accessible to everyone
At the kiosk
On a tablet at the entrance, with large touch targets.
- Accessible to everyone
Without an account
Through a link or a code that anyone can open.
- Public status page
Worked example: a worker asks for their data
A former employee asks for a copy of everything held about them.
Step 1: The request is recorded
The request is logged with its deadline, and the people who handle privacy requests are told.
Step 2: The data is gathered
The worker's records are gathered into one export, kept in write-once storage.
Step 3: A link is sent
The worker receives a link to their export that expires after two days.
Step 4: Erasure when asked
If they ask to be forgotten, the erasure is previewed first, and anything under a legal hold is kept and explained.
Read more
Industries that use it
Start with trust, privacy and security on its own.
Tell us how many people and locations you have. We will set it up with you, using your own forms and terms, and you add anything else only if you want it.