Security and data
Isolation per firm, encrypted secrets, protected sick leave and clear rules for personal data.
This is how GambIX is designed. Before you start you receive terms, a privacy policy and a data processing agreement (GDPR Art. 28).
| Topic | How it is handled |
|---|---|
| Where the data is | In a data centre in the European Union. |
| Isolation between firms | One database, but every row carries its firm, and the database itself (Row Level Security) will not return other firms’ rows, even if the app has a bug. |
| Sign-in | Google for the team, an emailed code for clients. No forgotten passwords. |
| Rights | By role, module and scope. The same for web, phone, “Ask” and MCP. |
| Secrets | Connections to Google and the bank password are stored encrypted, with a key kept outside the database. |
| Sick leave | Health information: the PDF is visible only to the employee and the admin, stored encrypted, and every opening is logged. |
| Personal finance | A separate cash book that only the owner sees. It never goes into the accountant’s pack. |
| Audit log | Who changed what, visible to admins. |
| Backups | A nightly copy of the database, also outside the main provider. |
| Narrow access: only chosen Drive folders. The mailbox is not read in full. | |
| AI | Knowledge is per client and never leaves the firm. The assistant works with the person’s rights. |
GDPR
The firm using GambIX is the controller of its clients’ and employees’ personal data. GambIX processes it on its behalf under a processing agreement (Art. 28). Sick leave is a special category of data and has separate protection.
The terms, privacy policy and processing agreement are being prepared and will be ready before the first outside firm.