Skip to content
Security & Compliance
Learn how Kayse AI keeps your data safe and helps you follow the rules. 🔒
🌟 Overview
Kayse AI is built with security baked in from the start. We use industry-standard practices to protect your data and help you stay in line with regulations.
🔐 Data Security
Encryption
| Layer | Protection |
|---|---|
| In Transit | All data is scrambled using TLS 1.2+ while it travels |
| At Rest | Stored data is locked with AES-256 encryption |
| Backups | Backups are encrypted with secure key management |
| API | All API calls must use HTTPS |
🏗️ Infrastructure Security
| Measure | Description |
|---|---|
| Cloud Hosting | Runs on top-tier cloud servers |
| Network Isolation | Private networks keep customer data separate |
| Firewalls | Web firewalls block attacks |
| DDoS Protection | Protection against overload attacks |
| Redundancy | Multiple data centers for reliability |
🏢 Data Centers
- SOC 2 Type II certified buildings
- 24/7 security guards
- Fingerprint access controls
- Climate monitoring and controls
🚪 Access Control
Authentication
| Feature | Description |
|---|---|
| Password Requirements | Minimum length and complexity rules |
| Two-Factor Authentication | Optional 2FA for all users |
| Session Management | Sessions expire after inactivity |
| Single Sign-On | SSO is available if you need it |
Authorization
| Feature | Description |
|---|---|
| Role-Based Access | Each role gets specific permissions |
| Least Privilege | People only get the access they need |
| Company Isolation | Data is completely separate between companies |
| API Key Scopes | API keys can be limited to specific tasks |
👥 User Roles
| Role | Access Level |
|---|---|
| Super Admin | Full access, including billing and security settings |
| Admin | Full feature access, but can't change security settings |
| User | Can only access assigned cases and basic features |
| Client | Portal access only — can see their own data |
📝 Audit Logging
What Gets Logged
Every important action is recorded:
| Category | Examples |
|---|---|
| Authentication | Logins, logouts, failed attempts, 2FA events |
| Data Access | Viewing records, searching, exporting |
| Data Changes | Creating, updating, deleting records |
| Settings | Changing settings, managing users |
| API Activity | API calls with times and results |
| Communications | Messages sent, calls made |
📅 Log Retention
| Plan | Retention Period |
|---|---|
| Standard | 90 days |
| Professional | 1 year |
| Enterprise | Up to 7 years (you choose) |
Accessing Logs
- Go to Settings → System Log
- Filter by date, person, or activity type
- Export for your records
🏥 HIPAA Compliance
For organizations that handle health info (PHI):
HIPAA Features
| Feature | Description |
|---|---|
| BAA Available | Business Associate Agreement for covered groups |
| PHI Encryption | Extra encryption for health information |
| Access Logging | Detailed records of who looked at health info |
| Minimum Necessary | Role-based access limits who sees what |
| Breach Notification | Steps to follow if there's a security issue |
Turning On HIPAA Mode
- Go to Settings → Company → Compliance
- Turn on HIPAA Compliance Mode
- Review and accept the extra terms
- Extra security controls turn on automatically
HIPAA Best Practices
- Turn on 2FA for everyone
- Use role-based access control
- Review audit logs regularly
- Train your team on HIPAA rules
- Keep health info out of custom fields and notes when possible
🔏 Data Privacy
Data Ownership
- Your data belongs to you
- We never sell your data to anyone
- We only use your data to run the service
Data Processing
| Aspect | Practice |
|---|---|
| Location | Data is processed in the United States |
| Subprocessors | Only a few trusted partners help us |
| Purpose | Data is only used to provide the service |
⏳ Data Retention
| Data Type | Retention |
|---|---|
| Account Data | Kept while your account is active, plus 30 days |
| Communications | You choose how long to keep them |
| Call Recordings | You choose (90 days by default) |
| Audit Logs | Based on your plan (90 days – 7 years) |
🗑️ Data Deletion
When you delete data:
- It's hidden right away (soft delete)
- Permanently erased within 30 days (hard delete)
- Removed from backups within 90 days
📤 Data Export
You can download your data anytime:
- Full data export available
- Standard formats (CSV, JSON)
- No vendor lock-in — your data goes where you go
📜 Compliance Certifications
Current Certifications
| Certification | Status |
|---|---|
| SOC 2 Type II | Certified ✅ |
| HIPAA | Compliant (with BAA) ✅ |
| GDPR | Compliant ✅ |
| CCPA | Compliant ✅ |
Compliance Reports
Request compliance documents:
- SOC 2 reports (under NDA)
- Security questionnaire answers
- Penetration test summaries
Contact security@kayse.ai for compliance questions.
🛡️ Application Security
Secure Development
| Practice | Description |
|---|---|
| Code Review | All code is reviewed before it goes live |
| Security Testing | Regular security checks |
| Dependency Scanning | Automatic scans for known problems |
| Penetration Testing | Yearly outside security tests |
Vulnerability Management
| Process | Description |
|---|---|
| Monitoring | Always watching for new issues |
| Patching | Critical fixes go out within 24–48 hours |
| Disclosure | Responsible disclosure program |
Security Headers
- Content Security Policy (CSP)
- HTTP Strict Transport Security (HSTS)
- X-Frame-Options
- X-Content-Type-Options
📡 Communication Security
🎙️ Call Recording Security
| Measure | Description |
|---|---|
| Encryption | Recordings are encrypted when stored |
| Access Control | Only people with the right role can listen |
| Retention | You set how long to keep them |
| Deletion | Securely deleted when time is up |
💬 Message Security
| Channel | Security |
|---|---|
| SMS | Sent through carrier-grade delivery |
| Encrypted with TLS while sending | |
| Chat | End-to-end encrypted |
🚨 Incident Response
Security Incident Process
- Detection — Automated tools spot the problem
- Assessment — We figure out how serious it is
- Containment — We stop it from getting worse
- Notification — We tell you within 72 hours
- Remediation — We find the root cause and fix it
- Review — We learn from it and improve
Reporting Security Issues
Found a security problem? Email: security@kayse.ai
We respond to security reports within 24 hours.
🔄 Business Continuity
Availability
| Metric | Target |
|---|---|
| Uptime | 99.9% available |
| RTO | Back up and running within 4 hours |
| RPO | No more than 1 hour of data lost |
🌐 Disaster Recovery
- Automatic switch to backup servers if something goes wrong
- Regular disaster recovery testing
- Clear step-by-step recovery plans
💾 Backups
| Type | Frequency |
|---|---|
| Database | Constantly copying data in real time |
| Full Backup | Once a day |
| Backup Testing | Tested every month to make sure they work |
✅ Security Best Practices
For Administrators
- Turn on 2FA for all users
- Use strong, unique passwords
- Review who has access every few months
- Check audit logs for anything weird
- Keep API keys secure
- Change API keys from time to time
- Set reasonable session timeouts
For Users
- Turn on two-factor authentication
- Don't share your login info
- Lock your screen when you walk away
- Report anything suspicious
- Use secure networks
- Keep your devices updated
For API Users
- Never put API keys directly in your code
- Use environment variables for keys
- Handle errors properly
- Watch your API usage for anything strange
- Use IP allowlisting when you can
⚙️ Security Settings
Options You Can Change
| Setting | Location |
|---|---|
| 2FA Enforcement | Settings → Security |
| Session Timeout | Settings → Security |
| IP Allowlisting | Settings → API |
| Password Policy | Settings → Security |
| Audit Log Retention | Settings → Data Retention |
📬 Contact
Security Team
- Email: security@kayse.ai
- Response Time: Within 24 hours
Compliance Inquiries
- Email: compliance@kayse.ai
- Documentation: Available under NDA
📅 Updates
This security page is reviewed and updated every few months. Last updated: February 2026.