Security

Customer data — accounts, workspaces, conversations, expense lines and uploaded files — is stored in a managed PostgreSQL database and file storage hosted in the European Union (Ireland).

The list of the service providers involved, with the data each one processes, is available to customers on request.

All traffic between your browser, Kiodo and its providers is encrypted in transit with TLS. Data is encrypted at rest by our database and storage provider.

Credentials for the integrations you connect are stored in a dedicated encrypted vault, are never returned to the browser, and can only be added or removed by a workspace owner.

Every record belongs to a workspace. Access rules enforced in the database itself restrict each record to the members of its workspace, in addition to the checks made by the application.

Uploaded files are kept in private storage and are only reachable by members of the workspace that uploaded them.

Members sign in with a password or with Google, and can protect their account with two-factor authentication through an authenticator app.

A workspace owner can require two-factor authentication from every member. Only owners can invite or remove members, and invitations expire.

The Google Drive connection uses the narrowest permission Google offers: Kiodo can only read the files you pick, never the rest of your Drive. Those files are read to be analysed and are not copied into Kiodo.

Kiodo does not use your content to train AI models. Content is sent to our AI providers only to carry out the feature you requested.

Access to customer content is limited to a small number of administrators, for support and troubleshooting. Kiodo staff have no screen to read your conversations, and each access to tool activity is recorded.

The database is backed up every day.

You can export your data and delete your account from Settings. Deleting the last account of a workspace deletes the workspace, its uploaded files and the stored credentials of its integrations.

Requests are validated and rate-limited, dependencies are checked for known vulnerabilities on every change, and errors are monitored without personal data.

Our hosting providers maintain independent security certifications such as SOC 2. Kiodo itself has not yet completed an independent audit.

Security questions and reports can be sent to tberrahal9@mgail.com.