Will the AI give financial advice?

It should not, and a responsible configuration routes anything that reads as advice to a qualified person. Otobiz answers process and status questions from your own documents.

Do you hold a security certification?

No. Otobiz holds no certification and does not claim one. We describe what the software does, and you can verify each of those claims against the behaviour of the product.

Can we prove what was sent and who approved it?

Yes. Every send is logged with the approver and the exact message that went out, and you can read that record inside the product at any time.

Can the audit record be edited?

No. Nothing in it can be edited or deleted after the fact, and it is checked nightly, so a change made any other way would be detected.

How is consent recorded?

As a permanent record of the exact wording shown, the source, and when. Consent is scoped by purpose, so a transactional basis does not authorise marketing.

Can we hide customer phone numbers from most staff?

Yes. Masking is applied when the data is read, so a restricted member never receives the raw value.

Where is our data stored?

In one cloud region. You cannot choose which.

Can customers send documents by message?

Yes on WhatsApp and Messenger. They attach to the customer record under the same access limits and masking as the rest of it.

What happens when a customer withdraws consent?

Suppression applies immediately and across every campaign and sequence, not only the one that prompted it, and the withdrawal is recorded as an event.

Answer the routine, hold the regulated.

Balance and status questions answered at any hour. Anything that reads as advice waits for a qualified person.

Lenders, brokers, and financial service providers use business messaging for servicing contact: application status, document requests, payment reminders, and process explanations. What makes this category different is that a wrong or unauthorised message carries regulatory weight, so the useful capability is a defensible record and a hard refusal to send certain things without a person.

What usually goes wrong.

One bad message is a regulatory problem: In most industries a poor reply is a poor reply. Here it can be an unauthorised communication, and the tooling usually offers no way to prove what was sent or who approved it.
Status questions swamp the servicing team: Where is my application, when is my payment due, and what document do you still need are high volume and low complexity, and they crowd out the cases that need judgment.
Personal data spread across staff phones: Customer details visible to everyone who has access, with no record of who read what, is a control failure waiting to be written up.

What Otobiz does about it.

Nothing sensitive goes out on its own

Campaigns, scheduled sends, and anything that writes to another system wait for someone to approve the exact message that goes out. An approver cannot be shown one thing while another goes out.

Approvals restricted to owners and admins
The message you approved is the message that sends
Approvals expire on their own

An audit trail that can be checked

Every consequential action is logged: what was sent, to whom, who approved it, and when. Nothing in that record can be edited or deleted afterwards, and it is checked nightly for signs of tampering.

One unbroken record per workspace
Insert-only for the application, with no update or delete
Nightly verification that escalates on a break

Access controlled per person

Members can be limited to their assigned customers, with phone numbers and email addresses masked at the point they are read, and export or deletion blocked individually.

Contact visibility limited per person
Personal data masked before it reaches a restricted member
Export, deletion, settings, and integration changes blocked per person

Consent recorded with the wording shown

Consent is recorded per purpose, permanently, with the exact wording the customer saw, where it came from, and when. Suppression applies across every channel and every campaign.

Separate transactional and marketing consent
The exact disclosure wording stored with the consent event
Opt-out keywords handled automatically with a confirmation

Documents collected with a record of who saw them

Customers send statements and identity documents on the thread, the files attach to the contact record, and access to them follows the same per-person restrictions as everything else.

Attachments stored against the customer record
Visibility limited per person, with personal details masked
Deleting the contact removes its messages and attachments

What matters most here.

Common questions

Will the AI give financial advice?: It should not, and a responsible configuration routes anything that reads as advice to a qualified person. Otobiz answers process and status questions from your own documents.
Do you hold a security certification?: No. Otobiz holds no certification and does not claim one. We describe what the software does, and you can verify each of those claims against the behaviour of the product.
Can we prove what was sent and who approved it?: Yes. Every send is logged with the approver and the exact message that went out, and you can read that record inside the product at any time.
Can the audit record be edited?: No. Nothing in it can be edited or deleted after the fact, and it is checked nightly, so a change made any other way would be detected.
How is consent recorded?: As a permanent record of the exact wording shown, the source, and when. Consent is scoped by purpose, so a transactional basis does not authorise marketing.
Can we hide customer phone numbers from most staff?: Yes. Masking is applied when the data is read, so a restricted member never receives the raw value.
Where is our data stored?: In one cloud region. You cannot choose which.
Can customers send documents by message?: Yes on WhatsApp and Messenger. They attach to the customer record under the same access limits and masking as the rest of it.
What happens when a customer withdraws consent?: Suppression applies immediately and across every campaign and sequence, not only the one that prompted it, and the withdrawal is recorded as an event.