Security at Kelu
We take security seriously. Learn about our practices, compliance, and how we protect your data.
Compliance
Audit of our security controls
In progressData processing agreement for your legal team
DPA availablePersonal data replaced with placeholders
Every planKeep no conversations at all
Every planSecurity Features
Encrypted Credentials
Keys and tokens you give Kelu for sources, bots, helpdesks and AI providers are encrypted with AES-256-GCM and never shown again after you save them.
Single Sign-On
OIDC or SAML 2.0 on the Enterprise plan, picked by your verified email domain. Require SSO turns off password, Google and GitHub sign-in for everyone on the domain except the workspace owner, who keeps a way in if the identity provider fails.
Two-Factor Authentication
Authenticator-app codes with backup codes. Passwords are stored as bcrypt hashes, never in plain text.
Key Controls
Secret keys are shown once and stored only as a hash. Public client keys can be limited to your domains and revoked at once.
Internal & Restricted Content
Internal knowledge bases have no public surface. Restricted documents are hidden from the widget, public API, form deflector and helpdesk replies.
PII Masking
Replace emails, phone numbers, card numbers, IBANs, IP addresses and titled names with placeholders, plus your own regex patterns. Every plan.
Data Retention Controls
Set how long conversations are kept, or choose zero data retention so nothing is stored.
Bring Your Own Model
Kelu sends content and questions to its AI providers to answer. Switch to your own provider account to keep that traffic under your contract.
Audit Trails
The Activity Log records sign-ins, member and role changes, and API key changes. Kelu staff access to your account is recorded too.
Security Practices
Sign-in
- Email and password, Google, GitHub or SSO
- Two-factor authentication
- bcrypt password hashes
- reCAPTCHA v3 on sign-in, sign-up and password reset
Your Data
- PII masking per knowledge base
- Custom regex patterns and allow-list terms
- Retention window or zero data retention
- Credentials encrypted with AES-256-GCM
- Readers identified by a random ID, no IP addresses in analytics
Who Sees What
- Roles: owner, admin, member, user
- Per-knowledge-base permissions
- Internal knowledge bases with no public surface
- Restricted documents inside public knowledge bases
- Activity Log for owners and admins
Responsible Disclosure
We welcome security researchers to report vulnerabilities responsibly. Please email security issues to our security team.
Report security vulnerabilities to:
Please include detailed steps to reproduce the issue. We aim to respond within 24 hours.
Questions about security?
Our security team is happy to answer questions and provide additional documentation.
Contact Security Team