Where your data is
What HeyKiko keeps, where it's kept, and which service handles it.
| Data | Where | Handled by |
|---|---|---|
| Files and images you or your customers upload | Singapore | DigitalOcean Spaces |
| The search index of your knowledge | United States (us-east-1) | Pinecone |
| Text sent to answer a message or index your knowledge | Sent per request | OpenAI, and the vendor of the chat model your plan uses (for example Google Gemini, Qwen, DeepSeek or Kimi) |
| Audio of WhatsApp calls the AI answers | Sent per call | ElevenLabs (speech to text and voice) |
| WhatsApp and Telegram messages | Delivered through the channel | Meta (WhatsApp Cloud API), Telegram |
| Bookings, when you connect a calendar | Your Google account | Google Calendar |
| Card details and invoices | Entered on Stripe's pages | Stripe (HeyKiko never stores card details) |
Signing in
- Passwords are hashed with bcrypt; nobody, including us, can read them.
- Sessions live in secure, HTTP-only cookies, one per device. Changing your password signs your other devices out; resetting it signs out every device.
- Two-step sign-in with a code by email, which you can turn on in Settings › Security.
- A password-reset link lasts an hour and stops working as soon as the password changes, and the reset page never says whether an address has an account.
- Reset requests and sign-in codes are rate-limited, and so is the public chat.
What you connect
- WhatsApp and Telegram tokens, AI provider keys, your email server's password and database connection details are encrypted with AES-256-GCM before they're stored.
- Messages from WhatsApp, Telegram and Stripe are checked for their signature or secret before HeyKiko acts on them.
- A connected database is read only. What a customer who isn't signed in may read is decided in code, not by the AI: no personal columns, no totals, and records about people only with an exact value the customer typed.
- Email campaigns go out through your own email server, and HeyKiko connects only to the address it checked, never to an internal one.
Who sees what
- Every request for an agent's data is checked against the account that owns it; anything else gets “not found”.
- The server checks a team member's access to contacts, campaigns, templates and calls on every request, and team members see their own cases and the unassigned ones.
- You choose which knowledge each group of signed-in customers can be answered from. A visitor who isn't signed in only gets what you've made public, and a customer's group comes only from a verified sign-in, never from what they type.
- Tests in the playground write nothing: no chat history, no bookings, no cases.
Privacy controls you run yourself
In Settings › Privacy, for each agent:
- Keep conversations for 30 days, 90 days, 1 year, 2 years or forever, then delete or anonymise them.
- Erase one customer: their details and conversations, found by exact phone number or email so nobody else is caught. Their opt-out is kept, so they aren't messaged again.
- Place a legal hold, which pauses retention and erasure while it's on.
- Erasures, retention runs and changes approved through Ask Kiko are written to an audit log.
AI and your data
- We don't train AI models on your data. Text goes to the AI provider only to index your knowledge and to answer a message.
- Answers come from your own knowledge, with the sources shown, and the agent can hand the chat to your team when your knowledge doesn't cover a question.
- Ask Kiko, the assistant in your dashboard, never changes anything without your approval: it shows a card, and only your click applies it.
What we don't have yet
So you can decide before you sign up, not after.
- No SOC 2, ISO 27001 or HIPAA certification. Don't use HeyKiko where you need a HIPAA business associate agreement.
- No in-country or EU-only hosting: files are stored in Singapore and the search index in the United States.
- No single sign-on (SAML or OpenID) yet.
Report a security issue
Email support@hannsville.com with “Security” in the subject and what you found. Please don't test against other customers' agents or data. Our data processing agreement and privacy policy set out the rest.
