Independently tested
An independent security specialist carried out a penetration test of the Colabi web app in January 2026, testing sign-in, sessions, access between accounts, APIs, file uploads and our cloud configuration. We re-checked every finding in October 2026. The fixes are complete in our code and are being released to the live service, and we review the code for security issues as we build.
Customers can ask for a summary of the test and how each finding was handled under a confidentiality agreement.
What is in place
Your data stays in Australia
The Colabi database and file storage run on Amazon Web Services in Sydney (ap-southeast-2).
Encrypted in transit and at rest
Connections use TLS 1.2 or higher. Stored data is encrypted by AWS, and database credentials are kept in AWS Secrets Manager rather than in the code.
Two-factor sign-in and lockouts
Two-factor authentication is available for every account. Repeated failed sign-ins are blocked, and web sessions time out when idle.
Each business sees only its own data
Access is checked on the server, and team members only see what the account owner gives them.
Verified connections
Messages from Stripe, Twilio and Upwork are checked for a valid signature before Colabi acts on them. Connected accounts use the provider's own sign-in, and you can disconnect at any time.
Card details never touch Colabi
Payments are handled by Stripe, a PCI DSS Level 1 provider. We never see or store full card numbers.
AI you can account for
- Colabi uses paid, commercial accounts with its AI providers, not free consumer tools.
- We do not use your business content to train AI models, and our providers' terms do not allow them to.
- When Colabi's AI chooses who does a task or shortlists freelancers, it shows why, and a person can review the decision.
- Callers speaking to a Colabi voice agent are told it is an AI.
Your data, your control
- You can export or delete your data on request. We respond within 30 days.
- We do not sell personal information.
- We publish every company that processes customer data for us on our sub-processor list.
- A data processing agreement is available for business customers. Email support@colabi.co.
- Our privacy policy covers the Australian Privacy Act, and the GDPR and UK GDPR where they apply.
Report a security issue
If you think you have found a security problem in Colabi, email support@colabi.co with "Security report" in the subject. Please give us a chance to fix it before sharing it publicly. If a breach affects your data, we will tell you without undue delay and notify regulators as the law requires.
Last updated 11 October 2026.