How we protect your data

• The organization a request belongs to comes from your signed-in session on our servers. It is never something the browser can choose or change.
• Every table that holds customer data is also protected by row-level security in the database itself. Even a mistake in application code can't return another organization's rows, including the directory of people.
• Each person belongs to one organization and joins only by accepting an invitation sent to their own email address, or through your single sign-on.

• Roles set what someone can do. A data scope (their own records, their team, their zone, or everything) sets what they can see, following your reporting lines.
• Fields can be made read-only or hidden per role, and that holds in lists, exports, search, reports and the AI agent alike.
• Importing and exporting leads, contacts and companies are separate permissions. Exports are audited and rate limited.
• Actions that can't be undone, like transferring ownership or deleting the organization, need a fresh password confirmation and the organization's name typed out.

• Two-factor authentication with an authenticator app, which admins can require.
• SAML single sign-on, which the owner can enforce for everyone.
• Verified email domains, so only addresses you've proven you own can be created as members directly.
• Personal API tokens (used for connecting Claude and similar tools) are stored hashed, expire within 90 days, follow your organization's sign-in policy, and can all be switched off at once by an admin.

• Traffic to and from Kairoq is encrypted in transit.
• Email bodies and meeting transcripts are encrypted with a separate key for each organization, so one organization's key never opens another's content.
• Tokens for connected tools and your payment gateway keys are encrypted before they are stored.

• The model never decides what it is allowed to do. Every action it proposes goes through the same server-side permission checks as the rest of the app, as the person who asked.
• Anything that leaves your organization, such as sending an email, bulk changes, deleting or exporting data, needs a person's approval first.
• Suggested CRM updates quote the words they came from, and each organization has monthly AI usage limits.

• An audit log records who changed permissions, members, settings and exports, and admins can read it.
• Our staff don't browse your records. The operator tools see support conversations you send us and usage counts, through narrow, audited database functions that check staff status in the database itself. Each look at your organization's usage is visible to your admins in Settings.

• Export your records at any time, in CSV or Excel.
• Handle access and erasure requests from your own customers, with a downloadable export and a confirmed erasure.
• Deleting the organization starts a 7-day grace period you can cancel, then erases everything.

We haven't completed a formal third-party audit such as SOC 2 or ISO 27001. If your security review needs a questionnaire answered or you've found a vulnerability, write to us. We'll answer, and we won't take action against good-faith research.