# Security and data > Where HeyKiko stores your data, how accounts and connected tools are protected, your privacy controls, and what we don't offer yet. Canonical: https://heykiko.io/security Last updated: 2026-11-05 5 November 2026 · checked against the product · by the HeyKiko team Where your data is kept, how we protect your account and the tools you connect, and the privacy controls you run yourself. Only what HeyKiko does today, including what it doesn't do yet. ## Where your data is What HeyKiko keeps, where it's kept, and which service handles it. | Data | Where | Handled by | | --- | --- | --- | | Files and images you or your customers upload | Singapore | DigitalOcean Spaces | | The search index of your knowledge | United States (us-east-1) | Pinecone | | Text sent to answer a message or index your knowledge | Sent per request | OpenAI, and the vendor of the chat model your plan uses (for example Google Gemini, Qwen, DeepSeek or Kimi) | | Audio of WhatsApp calls the AI answers | Sent per call | ElevenLabs (speech to text and voice) | | WhatsApp and Telegram messages | Delivered through the channel | Meta (WhatsApp Cloud API), Telegram | | Bookings, when you connect a calendar | Your Google account | Google Calendar | | Card details and invoices | Entered on Stripe's pages | Stripe (HeyKiko never stores card details) | ## Signing in - Passwords are hashed with bcrypt; nobody, including us, can read them. - Sessions live in secure, HTTP-only cookies, one per device. Changing your password signs your other devices out; resetting it signs out every device. - Two-step sign-in with a code by email, which you can turn on in Settings › Security. - A password-reset link lasts an hour and stops working as soon as the password changes, and the reset page never says whether an address has an account. - Reset requests and sign-in codes are rate-limited, and so is the public chat. ## What you connect - WhatsApp and Telegram tokens, AI provider keys, your email server's password and database connection details are encrypted with AES-256-GCM before they're stored. - Messages from WhatsApp, Telegram and Stripe are checked for their signature or secret before HeyKiko acts on them. - A connected database is read only. What a customer who isn't signed in may read is decided in code, not by the AI: no personal columns, no totals, and records about people only with an exact value the customer typed. - Email campaigns go out through your own email server, and HeyKiko connects only to the address it checked, never to an internal one. ## Who sees what - Every request for an agent's data is checked against the account that owns it; anything else gets “not found”. - The server checks a team member's access to contacts, campaigns, templates and calls on every request, and team members see their own cases and the unassigned ones. - You choose which knowledge each group of signed-in customers can be answered from. A visitor who isn't signed in only gets what you've made public, and a customer's group comes only from a verified sign-in, never from what they type. - Tests in the playground write nothing: no chat history, no bookings, no cases. ## Privacy controls you run yourself In Settings › Privacy, for each agent: - Keep conversations for 30 days, 90 days, 1 year, 2 years or forever, then delete or anonymise them. - Erase one customer: their details and conversations, found by exact phone number or email so nobody else is caught. Their opt-out is kept, so they aren't messaged again. - Place a legal hold, which pauses retention and erasure while it's on. - Erasures, retention runs and changes approved through Ask Kiko are written to an audit log. ## AI and your data - We don't train AI models on your data. Text goes to the AI provider only to index your knowledge and to answer a message. - Answers come from your own knowledge, with the sources shown, and the agent can hand the chat to your team when your knowledge doesn't cover a question. - Ask Kiko, the assistant in your dashboard, never changes anything without your approval: it shows a card, and only your click applies it. ## What we don't have yet So you can decide before you sign up, not after. - No SOC 2, ISO 27001 or HIPAA certification. Don't use HeyKiko where you need a HIPAA business associate agreement. - No in-country or EU-only hosting: files are stored in Singapore and the search index in the United States. - No single sign-on (SAML or OpenID) yet. ## Report a security issue Email support@hannsville.com with “Security” in the subject and what you found. Please don't test against other customers' agents or data. Our [data processing agreement](/dpa) and [privacy policy](/privacy) set out the rest. ## Security and data: questions ### Where is my data stored? Uploaded files and images are stored in Singapore with DigitalOcean, and the search index of your knowledge in the United States with Pinecone. Text is sent to the AI provider for each answer, WhatsApp and Telegram messages travel through Meta and Telegram, and card details stay with Stripe. HeyKiko doesn't offer in-country or EU-only hosting today. ### Do you train AI models on my data? No. HeyKiko sends your content to the AI provider only to index your knowledge and to answer a message, and doesn't train models on it. ### Does HeyKiko have SOC 2 or ISO 27001? Not yet. HeyKiko has no SOC 2, ISO 27001 or HIPAA certification today, and this page lists what it does instead. If your business needs one of those reports, HeyKiko isn't the right fit yet. ### Is HeyKiko GDPR compliant? HeyKiko gives you the controls GDPR asks for: erasing one customer, retention periods, a legal hold, and a data processing agreement. Compliance also depends on how you use it, and because data is stored in Singapore and the United States, transfers outside the EU apply. ### Can I delete one customer's data? Yes. In Settings › Privacy you can erase one customer's details and conversations, found by their exact phone number or email. Their opt-out is kept so they aren't messaged again. While a legal hold is on, erasing is paused. ### Are my WhatsApp and Telegram tokens safe? They're encrypted with AES-256-GCM before they're stored, like your AI provider keys, email server password and database connection details. Incoming messages are checked for WhatsApp's signature or Telegram's secret before HeyKiko acts on them. ### How do I report a security issue? Email support@hannsville.com with “Security” in the subject and what you found. Please don't test against other customers' agents or data. ## Related - [Privacy controls](https://heykiko.io/features/privacy-controls) - [Data processing agreement](https://heykiko.io/dpa) - [Privacy policy](https://heykiko.io/privacy)