Security & trust
Plain facts about how your data is kept.
No badge wall. What follows is what is true today, in one paragraph per topic, with the documents behind it.
Infrastructure
- Klayno runs on Amazon Web Services (AWS), through a Supabase project hosted in the European Union.
- Every workspace's data sits in PostgreSQL with row-level security, so one workspace can never read another's rows.
- Backups are taken daily by our infrastructure provider.
Data protection
- All traffic between your browser, our app and our database uses TLS 1.2 or higher.
- Data is encrypted at rest by our infrastructure provider (AES-256 on AWS-managed storage).
- Card data never touches Klayno. Payments are handled by Stripe, a PCI DSS Level 1 provider.
- You can ask for your workspace data to be deleted at any time; we delete it on request.
Access & permissions
- Permissions are role-based per workspace: owner, administrator, setter, closer, clients manager, content manager and client, with page-level access.
- Team invitations use tokens that expire.
- Sessions run on Supabase Auth, with email verification codes and Google sign-in.
- Every agreement sent for e-signature carries a full activity feed: sent, viewed, signed, with IP address and timestamp.
- Every action of the AI employee is logged, and actions that leave the workspace wait for approval at the default autonomy level.
Compliance
- Klayno is a US company and complies with the GDPR for the personal data of its European customers.
- Data of European customers is stored on AWS servers in the European Union.
- A data processing agreement is available on request, and our list of sub-processors is public.
- We do not hold SOC 2, ISO 27001 or HIPAA certifications today, and we do not display badges we cannot back with a report.
The documents behind this page
Report a vulnerability
If you believe you have found a security issue in Klayno, write to security@klayno.com with the steps to reproduce it. We read every report, reply within five business days, and keep you informed until it is fixed.
Please give us reasonable time to fix an issue before sharing it publicly, do not access or change data that is not yours, and do not run tests that degrade the service for other customers. We will not take legal action against research that follows these rules. We do not run a paid bug bounty today.
Questions a security review would ask?
Send them to us. We answer in writing and share the DPA on request.
security@klayno.com for anything technical.