klink.cloud handles customer conversations, and a conversation is personal data: phone numbers, recordings, transcripts, chat history and whatever a customer chose to tell an agent. Security is therefore a property of the product rather than a policy that sits beside it. Data is encrypted in transit and at rest, access is least privilege and reviewed, and single sign on, role based access control and audit logging are available to every tenant. The platform runs on AWS and on OVHcloud, in the region the customer chooses, including the United States, the European Union and Singapore.
We operate an information security management system certified to ISO/IEC 27001, covering the platform, the infrastructure it runs on and the people who operate it. Policies are reviewed at least annually, staff complete security training on joining and each year after, and changes reach production through peer review and automated checks. We meet GDPR obligations for European customers and the Singapore and Thailand PDPA for customers in those markets. Customers with stricter requirements can run klink.cloud in a private cloud or on premise, so regulated data never leaves an environment they control.
Compliance
-
ISO/IEC 27001:2022
Certified information security management system covering the design, development and operation of the klink.cloud SaaS platform for contact centers, unified communications and customer engagement.
-
SOC 2 Type II
Independent attestation of controls over security, availability and confidentiality across an audit period.
-
GDPR
We act as processor for customer data and as controller for our own. Lawful bases, data subject rights and retention are documented in the privacy policy, and a data processing agreement is available on request.
-
Singapore PDPA
Personal Data Protection Act 2012. Consent, purpose limitation, access and correction obligations are met, and data can be kept in the Singapore region.
-
Thailand PDPA
Personal Data Protection Act B.E. 2562. Lawful bases, data subject rights and cross-border transfer conditions are documented in the privacy policy.
Data residency
US, EU & SingaporeUS customers are served from AWS US regions, and their data stays in the United States.
US customers, and enterprises requiring US data residency
A European provider under European jurisdiction, for customers who need personal data to stay in the EU and to avoid transfers outside it.
EU customers, and enterprises with a data residency requirement
For customers in Asia Pacific who need data kept in Singapore, including under the Singapore PDPA.
Singapore and wider Asia Pacific customers
The platform runs inside an environment the customer controls, so regulated data never leaves it.
Regulated industries and enterprises with the strictest requirements
Resources
View all- Communicaiton Policy Internal and external communication of ISMS matters.
- Continual Improvement and Non Conformity Policy How non-conformities are recorded and improvements tracked.
- Information Security Policy The overarching information security policy.
- Internal Audit Policy How the ISMS is audited internally against the standard.
Controls
Updated 1 minute agoSynced automatically from our cloud infrastructure. Controls are reviewed on our ISO/IEC 27001 audit cycle. View allInfrastructure security
- Production hosted on AWS
- Data encrypted in transit
- Data encrypted at rest
Product security
- Single sign on available
- Role based access control
- Tenant data logically separated
Organizational security
- Security policies reviewed annually
- Security awareness training
- Background checks performed
Internal security procedures
- Incident response plan established
- Continuity and recovery plans tested
- Risk assessments performed
AI and model providers
- Model providers listed as sub-processors
- Customer data not used for model training
- AI features are opt in per tenant
Data residency
- Region chosen by the customer
- EU hosting on a European provider
- United States region available
Data and privacy
- Data classification policy established
- Data retention periods defined
- Customer data deleted on request
AI and customer data
No model trainingKai, our AI agent, uses large language models from established providers to understand a message and draft a reply. Only the conversation content needed to answer, together with the knowledge base content the customer has published to Kai, is sent to the model provider. Model providers are sub-processors and are listed as such.
- Customer data sent through these providers' business APIs is not used to train their models, under the providers' own published terms, which are linked in the sub-processor list.
- AI features are optional. A tenant that does not enable Kai sends nothing to a model provider.
- Prompts and responses are processed to answer the request, not retained by us for model development.
- Customers requiring that no data reaches a third party model provider can run a private deployment.
Sub-processors
View allInfrastructure
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Platform hosting, compute, storage and managed databases | Customer selected region, including the United States and Singapore |
| OVHcloud | Platform hosting for customers requiring EU data residency | European Union, Singapore |
AI model providers
| Sub-processor | Purpose | Location |
|---|---|---|
| OpenAI | Language model used by the Kai AI agent to understand and draft repliesAPI data is not used to train OpenAI models. | United States |
| Anthropic | Language model used by the Kai AI agent to understand and draft repliesCommercial API data is not used to train Anthropic models. | United States |
| Gemini language model used by the Kai AI agentPaid API data is not used to train Google models. | United States |
Customers under contract are notified before a new sub-processor with access to customer data is engaged. To subscribe to those notices, email support@klink.cloud.