BoringOps handles invoice photos, approval decisions, and financial records. Here's exactly what data we process, where it lives, and how it's protected.
Intake data
Message content
Text, photos, and voice notes sent to the BoringOps WhatsApp number. Only private (1-on-1) messages — not group chats. Content is processed for field extraction.
Job records
Structured fields
Vendor names, amounts, dates, categories, and job types extracted from messages. Stored as structured records in your workspace.
Approval log
Decisions
Approval or rejection decisions, the approver identity, and the timestamp. Required for audit trail and ERP sync.
Integration data
ERP credentials
API credentials for Accurate or Xero — stored encrypted and used only to post approved records. Never shared with third parties.
Encrypted in transit and at rest
All data transferred over TLS 1.2+. Stored records and credentials encrypted at rest using AES-256.
Workspace isolation
Each company's data is stored in its own isolated workspace. No data leakage between clients — critical for KAP and multi-entity setups.
Role-based access control
Users only see the departments and job types they're assigned to. Finance sees finance jobs; maintenance sees maintenance. Admins control access.
WhatsApp official API
BoringOps uses WhatsApp Business API — the official channel, not a third-party scraper. Messages are not stored beyond what's needed for job creation.
Data retention control
You control your data retention policy. Workspaces can be deleted on request. No vendor lock-in on historical records — export anytime.
Self-hosted option
Enterprise teams with strict data residency requirements can opt for a self-hosted deployment on their own infrastructure. Available under the enterprise plan.
No. BoringOps only receives messages sent directly to the BoringOps number. It does not access existing chats, groups, or contact history.
Default deployment uses cloud infrastructure in Southeast Asia. Enterprise deployments can specify region or opt for self-hosted on your own servers.
You can export all data at any time. On cancellation, workspaces are retained for a 30-day grace period, then deleted on request.
No. Your business data is not used to train or fine-tune AI models. Extraction models are pre-trained and do not adapt on your records.
Enterprise teams can discuss custom security review, data residency, and self-hosted options.