Security & Compliance Overview

Vobo Security & Compliance Overview

Last Updated: February 2026

1. Executive Summary

Vobo is a cloud-based mobile application platform designed to support communication, engagement, and content management for community organizations of all kinds.

This document provides an overview of Vobo’s security architecture, data protection measures, hosting environment, and governance practices.

Vobo is architected using a secure multi-tenant cloud infrastructure hosted within United States AWS regions. The platform prioritizes responsible data stewardship, access control, operational reliability, and transparency in handling customer data.

Vobo is committed to continuous improvement of its security and governance framework in support of its customer organization environments.

2. Platform Architecture Overview

Vobo operates using a multi-tenant architecture in which each customer organization functions within its own logically separated data environment.

The backend platform is deployed using:

Heroku (application hosting layer; Salesforce platform operating on AWS infrastructure)
Amazon Web Services (file storage, backups, and secure data transmission services)
MongoDB (database)
Firebase (push notification services)
Twilio (optional messaging services)

Mobile applications are dynamically rendered from centralized backend infrastructure, ensuring consistent codebase management while maintaining tenant data isolation. App rendering is performed with device code built using:

Android (Java)
iOS (Swift)

Production systems are isolated from development and testing environments.

3. Hosting & Infrastructure

Application hosting via Heroku (Salesforce platform operating on AWS infrastructure)
File storage and secure data transmission via Amazon Web Services (US regions)
MongoDB database hosting
Firebase for push notification delivery
Twilio for optional SMS and communication services
Production and development environments are separated
Automated infrastructure backups
Controlled deployment process from development to production

Vobo does not host production data outside of U.S.-based AWS regions.

4. Data Security Controls

4.1 Encryption

All data in transit is encrypted using TLS (HTTPS).
Database data is encrypted at rest (MongoDB).
File storage is not encrypted at rest (AWS).
Access to infrastructure and databases is restricted to authorized personnel.

4.2 Access Controls

Role-based administrative access (Main-Admin / Sub-Admin)
Principle of least privilege applied to administrative roles
Secure password storage practices (hashed credentials)
Administrative access restricted to authorized personnel
Optional Two-Factor Authentication (2FA) available for customer administrators

4.3 Environment Separation

Production data is isolated from development environments
Development testing does not utilize live tenant data

5. Data Privacy & Governance

5.1 Data Ownership

Customer organizations retain ownership of their data.

5.2 Data Location

All production data is stored within United States AWS regions.

5.3 Data Deletion

Customer organizations may request deletion of organizational data in writing.

Individual end users may request deletion of their personal data by selecting the “Delete My Data” option within their Vobo application and confirming the request.

Data deletion is performed subject to applicable legal retention requirements.

5.4 Privacy Policy

Vobo maintains a publicly available Privacy Policy located at: https://vobo.com/vobo-policies/

6. Payment Processing

Payment processing is handled by Stripe
Stripe is PCI DSS compliant
Vobo does not store credit card information on its servers

7. Subprocessors

Vobo utilizes established enterprise-grade service providers, which may include:

Heroku (application hosting platform; Salesforce platform operating on AWS infrastructure)
Amazon Web Services (file storage, backups, and secure data transmission services)
MongoDB (database services)
Firebase (push notification services)
Stripe (payment processing)
Twilio (optional messaging services)

Vobo remains responsible for oversight of subprocessors within the scope of its service obligations.

8. Backup & Business Continuity

Automated backups are performed through platform and infrastructure services (including MongoDB Atlas snapshots)
Backup procedures support restoration of tenant data
Production and development environments are separated to reduce operational risk
Vobo maintains internal procedures for service restoration in the event of disruption

9. Incident Response

As a small SaaS provider, Vobo maintains practical and proportional incident response procedures appropriate to its size and operational scope. These procedures include:

Monitoring infrastructure alerts via hosting providers (Heroku, AWS, MongoDB)
Investigation of anomalous activity or service disruptions
Containment actions when required (including service isolation)
Remediation and service restoration
Customer notification in the event of confirmed data-impacting incidents

While Vobo does not currently maintain a dedicated security operations team, incident response procedures are reviewed periodically and enhanced as part of ongoing security improvements.

10. Administrative Logging

Administrative access is role-restricted.

Vobo continues to evaluate expanded audit logging capabilities as part of its ongoing security enhancement roadmap.

11. Data Processing Agreement

Vobo offers a Data Processing Agreement (DPA) outlining roles, responsibilities, subprocessors, and data protection measures upon request.

12. Ongoing Security Governance

Vobo maintains a written security policy and continues to enhance documentation and operational controls in support of its customers.

Security governance practices are reviewed periodically to align with evolving operational and customer requirements.

13. Contact Information

For additional documentation or clarification, please contact:
Vobo LLC
info@vobo.com