Security and compliance
Security you can document, not just promise
Encryption, access control, a data processing agreement that holds up, and an independent audit you can attach to your tender. Here is what sits behind it.
GDPR is built in, not bolted on
When you send from Ubivox, we enter into a data processing agreement with you, so responsibility for personal data is clear from the start. We only process data on your instructions, make sure everyone with access is bound by confidentiality, and delete or return your data when our collaboration ends. You do not have to be a data protection expert to be covered. It is built into the way the platform works.
We are happy to sign the standard data processing agreements from the Danish Data Protection Agency and Local Government Denmark (KL) free of charge, so you do not have to negotiate a separate agreement to get started. If your organisation has its own agreement, we can sign that too. You can download the agreement inside the platform or ask our support to send it to you.
Our data protection officer
If you are unsure about anything to do with data processing or personal data, you can contact our DPO, Jens Wilsborg Stoklund, directly at dpo@ubivox.com or+45 70 70 13 37.
"We chose Ubivox so that we could stand behind our handling of GDPR 100 % in our newsletter work."
An independent auditor has reviewed all of it
Most providers call themselves GDPR-compliant. That is a self-declaration. We have gone a step further and had an independent auditor examine our data processing and information security against the recognised ISAE 3000 standard. The auditor tested our controls for access, encryption, logging, backup and data processing, and the conclusion was no qualifications. You can request the full report and attach it directly to your tender.
See the ISAE 3000 reportSecurity sits at the bottom of everything
Security is not a feature we added on top. It is the starting point for how the platform is built. Here are some of the measures you can verify yourself.
Encrypted all the way
All communication with the platform runs over encrypted connections, from administration to sign-up forms and images in your emails. You can test our encryption yourself with an independent SSL Labs test.
Test our encryption at SSL LabsAccess under control
You protect access with two-factor login, can restrict access to specific IP addresses, and the system automatically blocks after too many failed login attempts. Each user only has access to what their role requires.
Log in with your organisation's own accounts
Ubivox supports single sign-on via Microsoft Entra ID. Access is managed where you manage everything else, so an employee who changes department or leaves loses access in the same place as the rest of their access is closed.
Sending that stands up to scrutiny
We guide you through setting up SPF, DKIM and DMARC for your domain. We have done it many times. Bounces are handled automatically, and we keep an eye on the sender reputation of our servers. That is what a sender can do to give the email the best possible conditions. The rest is decided by the recipient’s mail server.
Your data stays within the EU
Where your data is stored is not a technical detail. For a public organisation it is a requirement you have to meet and be able to prove.
Danish-owned, data within the EU
Ubivox is Danish-owned, and your data is stored primarily in Denmark and always within the EU. We comply with the legislation that applies to you, and go further than it: our security and data processing are audited annually by an independent auditor in an ISAE 3000 report. We do not use American sub-processors, and you can always get an up-to-date overview of where your data is processed. Our hosting sub-processors are team.blue Denmark A/S in Skanderborg and Leaseweb, both named in the data processing agreement.
Backup if something goes wrong
We take an encrypted backup of your data every day and store it securely. Should anything go wrong, your information can be restored, and we test on an ongoing basis that it actually works.
Shall we document all of it for you?
Book a demo and we will go through security, data processing and documentation based on your requirements. You can also request the ISAE 3000 report and attach it directly to your tender.