So here is how it is held, in specifics rather than in adjectives: tenant isolation enforced in the database itself, a private brain behind a virtual network, and scanning on everything uploaded.
Oblifee is a compliance platform, so trust is the product. Here is exactly how your data is protected and how AI is used, in plain terms, without the reassurance-without-detail that usually fills a page like this.
Every market · every regime · cited absences
You sign in through Microsoft Entra External ID or Google. We never see or store a password of yours, and access is per person, not a shared login.
Every row of your data is fenced to your workspace by database row-level security, not by application code that could be bypassed. Inside a workspace you can also limit a colleague to specific businesses, and that limit is enforced the same way.
The database and the AI engine sit on a private network with no public access; file storage is reachable only through a private endpoint, authenticated with Entra, with no access keys to leak. Traffic to the platform is HTTPS only, always.
Imports and vault documents are scanned for malware by Microsoft Defender before a single byte is read or stored. An import file (a spreadsheet, an intake workbook, a spec) is deleted once its rows are loaded: we keep the figures, not the file. Documents you keep in the vault (certificates, test reports, artwork) stay on purpose as your compliance evidence, visible only to people your workspace admits.
Imports read only the columns the platform needs: SKUs, materials, weights, volumes. Any other column, including anything personal, is never read and never stored. There is no reason for customer or employee data to reach us, so it does not.
Each regulatory figure carries the citation and date it was read, and every load of the data is stamped to the exact reviewed change that produced it. Nothing about your compliance rests on an unsourced number.
AI is powerful in the right place and dangerous in the wrong one. In Oblifee it is used to read and to propose, never to state a fee. A model reads a packaging spec into structured components, or proposes a redesign; then the platform prices the result deterministically from the same cited rates that drive your dashboard. No number you rely on was invented by a model.
Your business data is sent to the AI provider only for the task you asked for, over an encrypted connection, and is not used to train anyone's models. Image generation runs in the EU data zone. A spreadsheet or spec you import is read and then deleted, leaving only the extracted figures; documents and artwork you keep on a product stay with that product, in your workspace. And the assistant, Obli, answers only from your own data and our cited brain, with estimates labelled as estimates: it explains and forecasts, it does not give binding legal advice.
Not to advertisers, not to anyone. There is no advertising anywhere in the platform.
Your products, volumes and specs are used to serve you, and are not fed into model training.
A spreadsheet or workbook you import is read, its rows are loaded, and the file is deleted. Vault documents are kept, fenced to your workspace by row-level security and SHA-256 fingerprinted on arrival. Every download is in the audit log, our staff enter a workspace only through a recorded step, and your owners and admins can delete them.
Each answer below says what is true today. Where something is planned rather than done, it says so. If your questionnaire asks something this page does not answer, email security@oblifee.com.
Oblifee runs in Microsoft Azure, UK South (London). The application, the workspace database, uploaded files and documents, the secrets vault and the backups are all in that region. The workspace database has no public address: the application reaches it over a private network. The application itself accepts traffic only from our Azure Front Door profile, which carries a web application firewall. Front Door ends the encrypted connection at Microsoft's nearest edge location and re-encrypts it to UK South.
AI processing is not all in the UK, so here is exactly where it runs:
| What | Where the request is processed |
|---|---|
| Obli's documentation search, commodity code search (matching), reading text on labels (OCR) | UK South only |
| The Obli conversation, reading documents and artwork, the label reader and label design check, ranking commodity codes | An Azure resource in UK South on Microsoft's Global Standard tier: anything stored stays in UK South, but Microsoft may process each request in any Azure region |
| Generating label images | An Azure resource in Sweden Central, Global Standard tier. No image generation model is offered in UK South |
| Obli, only when the Azure models have failed | Anthropic, on its own infrastructure in the United States. Never sent uploaded documents |
| Service email (invitations, alerts) | Azure Communication Services, Europe |
Microsoft does not use these AI requests to train models. Every company that processes data for us is on the sub-processor list, with what it sees and where. Enterprise customers can ask about UK-only processing.
If you think you have found a security problem in Oblifee, email security@oblifee.com with what you found, where, and how to reproduce it. We will acknowledge your report within three working days, tell you what we are doing about it, and tell you when it is fixed. Our contact details are also published in security.txt.
In scope: oblifee.com, oblifee.app, docs.oblifee.com, id.oblifee.com, agent.oblifee.app and status.oblifee.com.
Please: test only with an account of your own. Stop and tell us as soon as you can see data that is not yours, and do not keep or share it. Give us a reasonable time to fix a problem before you publish it.
Please do not: run denial of service or load tests, use social engineering or phishing, test against our staff or offices, or test the services of the companies we use (Microsoft, Stripe, Google and the others on our sub-processor list). Report those to them.
If you follow these rules in good faith, we will not take legal action against you for your research. We do not run a paid bug bounty.
Oblifee holds no security certification today. We are working towards Cyber Essentials Plus, and ISO/IEC 27001 is planned after that. We will list a certification here only once it is awarded, with its certificate number.
The infrastructure we run on, Microsoft Azure, holds its own certifications, including ISO/IEC 27001 and SOC 2. Microsoft publishes them on its Service Trust Portal. They cover Microsoft's part of the service, not ours.
Questions from your security or procurement team are welcome, and we will answer them specifically. Email security@oblifee.com, or reach us through the help centre.
Tenant isolation is enforced in the database itself through row level security, not only in application code. The regulatory database sits behind a private network, sign-in is through Microsoft Entra, and uploaded files are scanned.
Email security@oblifee.com with what you found and how to reproduce it. We acknowledge reports within three working days and will not take legal action against research done in good faith under the policy on the security page. Contact details are also in /.well-known/security.txt.
