Security

Last updated: 13 September 2026

This page describes the technical and organisational measures Recalld (Bit Robotics Ltd) uses to protect customer data. It is the security annex referred to in our Data Processing Agreement. Our internal policies (information security, incident response, disaster recovery, backup and retention, data protection, supplier management) are reviewed at least annually and are available to customers on request under NDA.

Infrastructure and data location

• Recalld runs as independent regional deployments. The EU region is hosted on servers in France with backups in Belgium, and the US region on servers in the United States, each with its own database, keys and backups. Accounts and data are never moved or replicated between regions.
• Each region is a small, fully described stack: an API gateway and one or more memory nodes, each with its own Postgres database. Servers are provisioned from written runbooks so any box can be rebuilt identically.
• Every server runs a host firewall exposing only the ports needed for its role. Administrative access is over SSH with key authentication only; password login is disabled.

Encryption

• All customer traffic uses TLS 1.2 or higher. Internal service-to-service calls carry a bearer token validated on the receiving side.
• Backups are encrypted at rest. Live servers run in OVHcloud datacentres with physical access controls; their database volumes are not separately encrypted.
• API and dashboard traffic goes directly to our servers. No CDN or proxy sits between you and the box that holds your data.
• Customer API keys are stored as hashes; the plaintext key is shown once at creation and never logged. Bring-your-own provider keys are stored encrypted and are never returned through the API.

Access control

• Every customer request is scoped to the calling account at the database layer, so one customer's memory is never visible to another.
• Multi-factor authentication is mandatory on every administrative account: cloud consoles, code hosting, DNS, email and the internal admin console.
• Production access is limited to named, authorised personnel on a least-privilege basis and is reviewed at least annually and removed on the day someone leaves.
• Customer data is never copied to development machines or used in benchmarks. Tests use synthetic or public datasets.

Backups and recovery

• Databases are backed up continuously (write-ahead log archiving, roughly every 5 minutes) with a full base backup every night, to encrypted storage at a different cloud provider from the live servers, in the same country as the region's servers.
• Backups are retained for 14 days, then pruned automatically. The backup account can only be administered from the Director's MFA-protected cloud account, not from the servers.
• A full restore to a scratch server is tested at least quarterly. The most recent drill, on 11 September 2026, restored both the gateway and the memory node in under two minutes each and passed all data checks.
• Recovery objectives: service restored within 8 working hours; data loss limited to 5 minutes where the log archive is intact.

Software and change management

• Source code lives in private repositories with secret scanning and dependency vulnerability alerts enabled. Third-party dependencies are pinned and reviewed regularly.
• Releases are built by CI from tagged commits and deployed through the admin console, never by hand. Secrets are injected from the environment and are never committed.
• Operating system and application security updates are applied within 14 days of release, critical updates as soon as practical.

Monitoring and incident response

• Application, authentication and system logs are kept for at least 90 days. Logs exclude request bodies and API keys.
• Uptime monitoring and provider security alerts notify us immediately of outages or suspicious activity.
• We maintain a written incident response plan. If a personal data breach affects your data, we notify you without undue delay and within 48 hours of becoming aware, and the UK Information Commissioner's Office within 72 hours where required.

Data handling

• Customer content is never used to train machine-learning models, and our sub-processors are contractually prohibited from doing so. The full list is on the sub-processor page.
• You can export all of your data and delete threads, agents or your whole account at any time. Account deletion is an immediate hard delete from live systems; backups roll off within 14 days.

Organisation

• Bit Robotics Ltd is a UK company subject to the UK GDPR and the Data Protection Act 2018, registered with the Information Commissioner's Office (reference ZC241638), with an EU representative under Article 27 EU GDPR (SKILL SOFTWARE SRL, Romania), and holds cyber and professional indemnity insurance.
• Everyone with access to systems reads and acknowledges the company's security and acceptable-use policies before access is granted and annually thereafter.

Reporting a vulnerability

If you believe you have found a security issue in Recalld, email support@recalld.ai with the details. We will acknowledge within 2 working days and keep you informed while we fix it. Please do not access other customers' data or disrupt the service while testing.