Argentina in River Plate Spanish; the rest in neutral Spanish; English for everyone else.
Cobratia talks to your customers, connects to your system and organizes payments. That means you entrust us with your portfolio. This page explains, plainly, what we do to protect it.
Last updated: August 17, 2026
They aren't brochure promises: every point can be verified in the product.
Each company's data lives in a separate space within the database. It isn't a filter a programming error could skip: it's isolation at the engine level. One company's data can't mix with another's.
The access keys to your system, the collection credentials, the WhatsApp token and the email passwords are stored encrypted with AES-256-GCM, the same family banks use. The master key doesn't live in the database or the repository: it's in the server environment, so a copy of the database isn't enough to read them.
Within your account, each person on your team has their own role and sees only what's theirs: whoever consults can't modify, and whoever operates doesn't enter the configuration. Sessions are revoked instantly. The panel supports two-step verification for the accounts that need it.
Payment notices arrive through signed and verified channels, and are credited only once even if they arrive repeated. By default Cobratia reports and labels payments without touching your system's debt; having it also write the debt is enabled only if you ask and your system allows it.
The usernames and passwords your team stores for each customer are encrypted, only an administrator can see them and every time someone looks, it's logged. From your Google account, Cobratia sees only the calendar's "busy / free" and the files it uploads itself, which stay in your company's Drive. And a quote's link doesn't say which company it's from: if you change it, the previous one stops opening.
Automatic copies every day, on more than one medium and off the server, with a written procedure to rebuild the service on a new machine.
We ran internal audits and a penetration test. Every finding was corrected, with an automated test watching so it doesn't come back.
Only what's needed to do collections and service. Nothing more.
| Data | What for |
|---|---|
| Debtor's contactname, phone, email | Reach them on WhatsApp, Telegram or email, on your behalf. |
| Debt and paymentsamounts, due dates, receipts | Remind, report the account status and organize the payments received. |
| Address and delivery detailsif applicable | Arrange deliveries and alert the driver, at customers who sell. |
| Conversationswhat was discussed on each channel | Give continuity to service and keep a record of what was discussed. |
| Sales follow-upif you use the CRM: notes, tasks, meetings, quotes | Your team keeps every deal and every customer in one place, assigned to someone. |
None of this runs on a computer under a desk. Cobratia is mounted on professional infrastructure, with each platform's official channels and enterprise-grade protection at the front door.
The data is yours and your customers'. You're in charge, at any time.
We want to know. Write to us at seguridad@cobratia.com with the details and, if you can, how to reproduce it. We acknowledge receipt, investigate and keep you posted on the fix.
We have the standard security questionnaire for cloud providers answered, and we send it on request together with the technical details your assessment needs.
What people ask us most before getting started. If something's missing, write to us and we'll answer it.
On a dedicated server in Germany, within the European Union. It isn't a shared account: it's our own machine, with restricted access.
Only the technical team that operates the platform, with two-factor sign-in and a record of every action. No other customer can see it: each company has its own database schema.
No. Your portfolio's data is used solely to provide you the service. It isn't passed to third parties for commercial purposes nor does it feed the training of any model.
We tell you first, with what we know and what we don't yet, and with the measures taken. Notifying the supervisory authority is the responsibility of the data controller, which is you, and we support you with the technical information.
No, and we'd rather say so before you ask. What there is, is on this page and can be verified in the product: isolation, encryption, two-factor sign-in, backups and a penetration test.
By writing to the channel listed further down this page and in the site's security.txt file. We respond within the committed time and take no legal action against anyone who reports in good faith.
Security is one part. This is what the platform does and what's done with the data.