Security FAQ

Asyncbot · Last updated: September 2026

This page answers common security questions from teams evaluating Asyncbot. For detailed data handling practices, see our Privacy Policy.

Data Storage

Where is my data stored?

Your rotation data lives in the European Union, on servers in Paris, France (Hostinger infrastructure). Some providers we depend on process data elsewhere: Slack and Sentry are in the United States, Stripe is in the United States and the EU, and HiBob follows your company's region. Traffic to our API passes through Cloudflare's global edge. See Subprocessors for what each one receives.

What data do you store?

Data Type	Stored?	Purpose
Slack workspace ID & name	Yes	Identify your workspace
Slack user IDs	Yes	Assign users to rotations
Slack display names	Yes (cached)	Render names in rotation cards and notifications
OAuth bot tokens	Yes (encrypted)	Post messages on your behalf
Rotation configurations	Yes	Operate your schedules
OOO dates & leave types	Yes	Skip unavailable people during rotation. Leave types stored only when synced from HiBob integration
Handoff notes	Yes (encrypted)	Free-text shift notes written by your team. Encrypted at rest with AES-256-GCM. Stored to deliver to the next person in the rotation
Coverage handoff events	Yes	Who covered for whom, and when. User IDs and the action only, no message content
Stripe billing IDs	Yes	Link your workspace to your subscription. Payment details (card, address) are stored by Stripe, not by us
User emails	No	Used transiently during HiBob sync to match employees to Slack users, then discarded. Never stored in our database
Channel message content	No	We never read channel history and hold no permission to
Messages you send the app	Yes	Direct messages to Asyncbot are stored so support can answer them. This is the one message path we read
Handover notes	Yes (encrypted)	Free text you write when handing over, so the next person has context
Passwords or user tokens	No	We use OAuth bot tokens only. No user passwords or user-level tokens

How long do you keep data?

Active workspaces: As long as Asyncbot is installed
After uninstall: 14-day grace period (a reinstall inside it restores the workspace as it was), then permanent deletion
On request: Immediate deletion available. Email [email protected]

Encryption & Security

Is my data encrypted?

Yes.

In transit: Traffic between you, Slack and our API is encrypted with TLS. Enforcing TLS on the internal database connection is planned and not yet in place
At rest: OAuth tokens, integration credentials, and handoff notes are encrypted using AES-256-GCM
Database: PostgreSQL on dedicated VPS infrastructure

What Slack permissions do you request?

We follow the principle of least privilege. This is the complete list, kept in step with the app manifest:

Scope	Purpose
`channels:join`	Join a public channel a rotation posts into
`channels:read`	Read the name and type of a channel picked for a rotation
`chat:write`	Post rotation cards and DM notifications, and update ones already sent so the name shown is never stale
`chat:write.public`	Post into a channel the app has not joined, rather than adding itself to send one message
`commands`	Handle the /rotation and /async slash commands
`groups:read`	Read the name of a private channel a rotation posts into
`im:history`	Receive direct messages people send to the app, which is how support reaches a person
`im:read`	Tell a direct message apart from channel activity on arrival
`im:write`	Open a DM to send a handover note, a turn reminder, or a support reply
`users:read`	Read display name and timezone for the people in a rotation
`users:read.email`	Match a Slack user to a HiBob employee by email. Requested at install, and only ever used by workspaces where an admin connects HiBob. Email is not stored.

We removed channels:history on 1 September 2026. The app never called it, and it granted far more than the feature needed.

Do you have SOC 2 certification?

Not yet. We're a small, bootstrapped team focused on product quality. Our security practices follow industry best practices, but we haven't undergone formal SOC 2 audit.

If SOC 2 compliance is a requirement for your organization, please contact us to discuss your needs.

Infrastructure

What infrastructure do you use?

Component	Provider	Location
Application hosting	Hostinger VPS	Paris, France (EU)
Database	PostgreSQL (self-hosted)	Paris, France (EU)
CDN / DDoS protection	Cloudflare	Global edge network
DNS	Cloudflare	Global

What's your uptime target?

We target 99.9% uptime (this is an internal target, not a contractual SLA). Asyncbot is designed to be resilient — if our servers are temporarily unavailable, your Slack workspace continues to work normally. Scheduled rotations will catch up when service resumes.

Backups

Do you backup data?

Yes. We perform daily automated backups kept 5 days. We have not yet completed a documented restore test.

Can I export my data?

Yes. Under GDPR, you have the right to data portability. Contact [email protected] with your workspace ID to request an export of your rotation data.

Incident Response

Vulnerability disclosure

Report anything you find to [email protected]. One person reads that address and answers it. We acknowledge every report within 24 hours and aim to resolve critical issues within 72 hours.

In scope: the AsyncBot Slack app and its API at api.asyncbot.app, this website, and the OAuth and billing flows. The Slack app is the product, so anything affecting it is in scope.

Out of scope: Slack's own platform, our sub-processors' infrastructure, denial of service, social engineering, and reports generated by an automated scanner with no working proof.

What we ask: give us a way to reproduce it, use a test workspace rather than someone else's data, and give us a reasonable window before publishing. We will credit you if you want it.

What we do not offer: we have no bug bounty and pay no rewards. We would rather say that plainly than imply otherwise.

Machine-readable contact: /.well-known/security.txt

How do I report a security issue?

Email [email protected]. We acknowledge all reports within 24 hours and aim to resolve critical issues within 72 hours.

Our security.txt file is available at /.well-known/security.txt.

What happens if there's a data breach?

In the unlikely event of a data breach affecting your workspace:

We will notify affected workspace administrators within 72 hours as required by GDPR
We will provide details on what data was affected
We will outline steps we're taking to prevent recurrence

Subprocessors

We use the following third-party services to operate Asyncbot:

Provider	Purpose	Data Location
Hostinger	Application & database hosting	Paris, France (EU)
Cloudflare	CDN, DDoS protection, DNS	Global edge network
Slack	Platform integration (your workspace)	US (Slack's infrastructure)
Stripe	Payment processing (Pro plans)	US/EU
HiBob	Optional HRIS integration, enabled by a workspace admin. Employee matching and time off sync, and creating or cancelling time off requests where that is switched on	US/EU (customer's HiBob region)
Sentry	Error monitoring and performance tracking	US

We evaluate subprocessors for security and GDPR compliance before integration.

Compliance

Yes. We are based in Belgium (EU) and designed Asyncbot with GDPR compliance from day one:

Data minimization: we only collect what's necessary
EU data residency: primary data storage in EU; see Subprocessors for full picture
Data subject rights: access, rectification, erasure, portability
14-day post-uninstall deletion (backups persist up to 5 more days, so the last recoverable copy is gone by day 19)

Do you sign DPAs (Data Processing Agreements)?

Yes. Contact [email protected] if your organization requires a DPA.

Contact

Topic	Contact
Security issues	[email protected]
Privacy questions	[email protected]
Legal / DPAs	[email protected]
General support	[email protected]

Legal entity: Sven Meys BV, Belgium