Security

At BOTS4.me, security isn’t just a feature—it’s fundamental to everything we do. Our business depends on protecting your data, which is why we’ve built our platform with comprehensive security measures that meet and exceed industry standards for business automation services.

Encrypted at Input, Decrypted Only in Memory

Two-Factor Authentication

Privacy First Design

Limited Data Retention

Zero-Touch Disk

Zero Security Incidents Over 2 years of operation

🔐 Secure Quick Connect (OAuth) Explained

Most modern services (Gmail, Outlook, Google Drive, OneDrive, Dropbox, Box) support “OAuth” – a security standard where you log in directly on THEIR website, never giving us your password. They confirm your identity and give us a special permission key that only does what you approved.

For services that don’t support OAuth yet, your credentials are encrypted with RSA-2048 the moment you enter them. Either way, you have complete control from your /bots dashboard.

Works with 27 services: Gmail, Outlook, Microsoft 365, Google Drive, OneDrive, Dropbox, Box and more

Multi-Layer Encryption

We implement industry-standard encryption protocols including enterprise cloud encryption services and RSA key pairs to protect your data both in transit and at rest.

Isolated Infrastructure

Your automation processes run on dedicated, protected servers with strict access controls and comprehensive security monitoring to prevent unauthorized access.

Privacy by Design

Sensitive information is encrypted at the point of submission and remains encrypted throughout our systems. Only authorized processes can access your data when needed.

Transparent Practices

We maintain clear data handling policies and provide comprehensive documentation about our security practices, so you know exactly how your information is protected.

Secure Quick Connect (OAuth 2.0) – The Most Secure Option

For major providers like Gmail, Outlook, Google Drive, Dropbox, OneDrive and Box, we support industry-standard Secure Quick Connect (OAuth 2.0) – the same secure method used by millions of applications worldwide.

What is OAuth and Why It’s Better

No Password Storage: You never enter your email or cloud storage password on our website. Instead, you log in directly on Google, Microsoft, or Dropbox’s own secure login page.

Limited, Listed Permissions: OAuth gives us only the specific scopes you approve on the provider’s consent screen. For Microsoft 365 / Outlook, that means scopes like IMAP.AccessAsUser.All, Mail.ReadWrite, MailboxSettings.ReadWrite and (for Mail2CLOUD) the narrow Files.ReadWrite.AppFolder scope that can only see a single folder we create. For Gmail, the Gmail API scopes gmail.modify (read, label, move to Trash, insert and send — never a permanent delete) and gmail.settings.basic, and (for Mail2CLOUD on Google Drive) drive.file, which can only see files our app created. The full per-scope justification is in our Privacy Policy.

Revoke Anytime: You can instantly revoke BOTS4.me access from your Google or Microsoft account settings without changing passwords or contacting support.

Industry Standard: OAuth 2.0 is used by thousands of trusted applications and is the recommended authentication method by Google, Microsoft, and other major providers.

How OAuth Login Works

Click “Connect with OAuth”

Redirected to provider’s secure login

Approve permissions on their site

Secure token sent to BOTS4.me

Token encrypted & stored securely

OAuth vs. Password: You Choose

We give you the choice between OAuth (recommended for supported providers) and traditional app passwords/API keys. Both are secure – OAuth just eliminates password storage entirely. For services that don’t support OAuth, your credentials are protected with RSA-2048 encryption.

Or Connect Nothing: Forward to Us

Mail2ERP, Supplier2ERP, Pay2ERP and Mail2KNOW also work without any mailbox connection: add the BOTS4.me Mailbox to the app on your BOTS dashboard (one click, no password) and forward emails to the app’s address, for example mail2erp@bots4.me. We accept only mail forwarded from your account address, or from the addresses you list under “Forward to us” in the app’s Control (Mail2KNOW: “Who may teach and ask”). Before anything is written to your ERP, we check that the email really comes from that address – when that cannot be verified, you confirm it with one click. The same email forwarded twice is processed only once. Your email is deleted from our mailbox right after processing, after 7 days at the latest if it could not be processed, and anything we could not match to an account is deleted after 14 days.

What We Never Do With OAuth-Granted Access

We never use your email content, contacts, attachments or any Google/Microsoft user data to build, train or improve generalized or third-party AI/ML models. Models are tuned on your account’s own data only.
We never sell your data, share it with advertising networks, or use it to serve targeted ads.
We never read mail or open attachments for human review except where strictly required to deliver a feature you activated, or where you explicitly request support troubleshooting on a specific message.
We never permanently delete mail, files or folders that we did not create – unless you switch on a clean-up feature that does exactly that (AutoSPAM “Automatic Clean-up” and “Clean Sent Folder”, Mail2CLOUD “Cleanup of old emails using AutoSPAM”).
We never transfer OAuth tokens to any party outside our infrastructure, except to the issuing provider (Microsoft or Google) when we exchange or refresh them.
We comply with the Google API Services User Data Policy, including the Limited Use requirements.

How We Protect Your Business Data

When you trust BOTS4.me with access to your ERP and email systems, we take that responsibility seriously. Our security architecture is designed specifically for the unique challenges of business process automation:

Secure Data Transmission

Every connection between your systems and our platform is protected:

Modern TLS encryption ensures all data in transit is protected from interception

Separate key storage – the private key exists only on our processing servers, in an encrypted file, never on the web server

API authentication using industry-standard protocols and secure tokens

Zero-Disk Decrypted Data Protection

Our most rigorous security practice – even while processing, we NEVER save anything in decrypted form to disk:

Memory-only processing – all operations happen exclusively in RAM, decrypted data exists only during active processing (seconds to minutes)

No unencrypted temporary files – caches and logs are stored encrypted, and nothing decrypted remains if a server loses power

Limited retention – logs are deleted automatically after 90 days; other working data follows our retention schedule and is then deleted automatically

Encrypted at rest – your data is ALWAYS stored encrypted and never written to disk in plain text

Immediate removal upon customer request with verification, including backups

RSA-2048 Encryption Architecture

How we protect your credentials with public-key encryption:

Instant encryption – when you save credentials in /bots, they’re immediately encrypted with our public key; only the processing servers hold the private key

Separated key storage – encryption keys stored separately from encrypted data in different secure locations

Processing flow – data decrypted in memory only, processed, then results encrypted again

Decrypted only in memory – your credentials are encrypted the moment you enter them and decrypted only in memory, only on our isolated processing servers, for the seconds a bot needs them

Access Control & Authentication

Multiple layers of security protect access to your systems:

Secure Quick Connect (OAuth 2.0) wherever the service supports it – Gmail, Outlook, Microsoft 365, Google Drive, OneDrive, Dropbox, Box and more. Your password NEVER touches our servers. For legacy systems: RSA-2048 encrypted credentials.

Two-factor authentication for every user account, and required for all of our administrative access

Custom-developed protection system against common attack vectors

Comprehensive activity logging for security monitoring and auditing

Security Standards Comparison

See how our security measures compare to typical automation services:

← Scroll horizontally to view all columns →

Security Feature	Basic Services	Industry Standard	BOTS4.me
Data Encryption	Basic SSL	TLS + Storage Encryption	Encrypted at Input, Decrypted Only in Memory
Authentication	Password Only	Optional 2FA	2FA for every user
Data Retention	Indefinite	90-180 days	Automatic deletion
Processing Method	Standard Storage	Encrypted Storage	Zero-disk Processing
Access Monitoring	Basic Logs	Activity Tracking	Comprehensive Auditing
Infrastructure	Shared Servers	Virtual Isolation	Dedicated Servers (Premium) / Isolated Processes (Standard)
Disaster Recovery	None	Daily Backups	Encrypted Off-site Backups + Automatic Takeover

Data Privacy & Compliance

We’ve designed our platform with privacy at its core, ensuring your business data is handled with the utmost care and in compliance with data protection best practices:

Minimal Data Collection: We only process the data necessary for your specific automation needs – nothing more.
Transparent Data Handling: Clear documentation of what data we access, how it’s processed, and when it’s deleted.
User Control: You maintain full control over your data with the ability to request immediate deletion at any time.
Encrypted Form Submissions: Sensitive information entered during onboarding is encrypted immediately upon submission.
Separate Key Management: Encryption keys are stored separately from encrypted data for enhanced security.
No Unnecessary Storage: We don’t store any data we don’t actively need for your automation processes.

Operating Without AI

Some organizations are not permitted to process business data with AI — banks and insurers under internal policy, public-sector bodies under procurement rules, and suppliers bound by a customer contract. Most of our automation was built on rules long before it was given AI, and it still runs that way.

Five bots contain no AI at all: AutoERP, AutoCASH, AutoSTOCK, AutoPURCHASE and Mail2CLOUD. There is no switch, because there is nothing to switch off.
Four bots have an AI Mode switch: AutoSPAM, Mail2ERP, Pay2ERP and Supplier2ERP. Set to Off, no language model is called and no content is sent to any AI provider. These bots still use statistical matching, which runs on our own servers and never sends your data to a third party.
Three bots cannot work without AI: ClientFACTORY, Mail2KNOW and AutoGEO generate written text. We say so here rather than let you find out after you buy.
Off means off: setting AI Mode to Off takes effect on the next run and overrides every other setting, including Demo Mode.
Evidence for your file: on request we will send you a report generated from your own installation, listing the resolved AI mode of every bot on your account.

Demo Mode — Your Safety Switch

Demo Mode is a built-in safety control that lets you verify exactly what the bot would do before enabling full automation. It is enabled by default for all new accounts, ensuring a safe starting point.

Safe by default — Demo Mode is ON for every new account. No data is written to your ERP or cloud systems until you explicitly choose to allow it.

Proof before automation — every app must complete at least one demo run and email you a report of exactly what it WOULD have done before Demo Mode can be switched off. The first run is always a demo — nothing is ever written without your informed consent. More about Demo Mode →

One-click safety — you can switch Demo Mode back ON at any time from the Control tab on your /bots dashboard, effective immediately. Switching Demo Mode OFF unlocks only after your first demo run report — so live writes can never be enabled by accident.

Non-destructive preview — With Demo Mode ON, the system continues to monitor, analyze, and report, but will not write any changes. You can see exactly what would happen without risk.

Always available — Even with full access configured, Demo Mode gives you a safety switch to prevent unintended changes at any time. Perfect for testing, audits, or onboarding new team members.

Infrastructure Security

Our technical infrastructure is built with security as a fundamental requirement:

Enterprise cloud infrastructure with institutional-grade security configurations

Regular security updates and proactive vulnerability management

Isolated processing environments for each customer’s automation tasks

Automated security monitoring to detect and prevent suspicious activities

Secure development practices with code review and security testing

Regular backup procedures with encrypted storage and secure recovery

Server Architecture & Isolation

We’ve implemented intelligent server assignment to optimize both security and performance:

Enterprise/Premium Clients – dedicated isolated servers with resources exclusively for your needs, no sharing with other clients, complete isolation

Standard Clients – “pool” servers with harmonized resource allocation, isolation between clients (each client runs as an isolated process), same encryption and security standards

All Plans Include – encrypted the moment you enter it, stored only encrypted, decrypted only in memory (never written to disk in plain text), automatic data cleanup on a fixed retention schedule, monitoring with automatic alerts

Business Continuity — Contingency

If a server fails, your automation does not wait for us:

Encrypted off-site backups – your data is encrypted with AES-256 before it leaves our server. The backup storage only ever sees encrypted data and the key never leaves our servers. Every backup is read back byte-for-byte after upload.

Restore-tested every week – another server downloads and decrypts the latest backup every week to prove it can really be restored.

Automatic takeover – our servers confirm every minute that they still own your account. If the server running your automation goes silent, another server in our cluster takes your account over from the latest backup. The failed server is locked out, so your account never runs twice. When the original server is healthy again, your account moves back automatically at night.

Your mailbox is the queue – email that arrives during an outage waits in your inbox and is processed after the takeover. Data already written to your ERP stays there.

← Scroll horizontally to view all columns →

Contingency	Enterprise & Business	Other paid plans
Encrypted backup	Every hour, login tokens on every change	Daily
Back online after a server failure	Within about 10 minutes	Within about 2 hours
Processing history lost at most	1 hour	24 hours

Today our servers run in one data center, with backups at a separate provider; more servers and locations are being added.

“We’ve been working with BOTS4.me for over two years now, processing thousands of emails and transactions. In all that time, we haven’t experienced a single security incident or service interruption. Their commitment to data protection and reliable service has been consistent from day one.”

Miroslav Petras

Managing Director, IMP Kontakt

💼 Growing Startup, Professional Standards

We’re a growing startup committed to professional-grade security practices. While we’re working toward formal certifications (SOC 2, ISO 27001), we’ve already built our platform around the core security practices these frameworks emphasize. Our zero-disk decrypted processing, automatic data deletion, and Secure Quick Connect (OAuth) approach demonstrate our commitment to your data protection from day one.

Built on a Foundation of Trust

We understand that automation requires access to critical business systems. That’s why we’ve invested heavily in security infrastructure and practices that protect your data while enabling powerful automation. Let’s discuss how our security measures align with your business requirements.

Ask us if you’re still concerned.