Security

Learn more about our data security practices and compliance measures.

Overview

Kuuumba is built with best-in-class security practices to keep your work safe and secure at every layer. This includes state-of-the-art encryption, safe and reliable infrastructure partners, and independently verified security controls.

Kuuumba is also open source under the AGPLv3. The code that runs the hosted product is on GitHub.

To request a Data Processing Agreement (DPA) with specific details, contact us at [email protected].

Shared responsibility

Under our shared responsibility model, Kuuumba secures the components that we control, including the application layer, underlying platform, and cloud infrastructure. This includes protecting against threats targeting these components through security controls, monitoring, and incident response.

Customers are responsible for how they use Kuuumba. This includes configuring team access and roles, determining what data they share into which channels, deciding which documents have public links enabled, managing the agents and MCP clients they connect, and maintaining the security settings on the Google account they sign in with.

Certifications

Kuuumba is compliant with GDPR, SOC 2 Type II, ISO 27001, and HIPAA. Our certifications cover the hosted product at kuumba.dev.

For HIPAA compliance, we offer a Business Associate Agreement (BAA) to customers handling protected health information. Please contact us at [email protected] for more information.

To request other security and compliance documents for Kuuumba — audit reports, our subprocessor list, or a completed security questionnaire — please email [email protected]. If you have further questions about any of our certifications, please let us know at [email protected].

FedRAMP, or anything else that requires Kuuumba to run inside your own infrastructure, is a separate conversation — contact [email protected]. Self-hosting under the AGPLv3 is covered in the FAQ.

Data regions

You have the option to select the region where you want your data to be stored. The available options are:

  • United States
  • European Union

The United States is the default. Selecting the European Union isn't self-serve — email [email protected] and we'll create your workspace in an EU region.

Most of the data associated with the workspace — including email, messages, documents, tasks, call recordings, and CRM records — will only be stored in the selected region, across three systems inside it:

  • Postgres for blocks and the relationships between them
  • S3 for files, attachments, images, and call recordings
  • OpenSearch for the index that powers Search

Access control

Access in Kuuumba is derived from channel-based sharing rather than per-file permission dialogs. That model is the security boundary:

  • Mentioning a block in a channel shares it with every member of that channel. Removing someone from the channel revokes what was shared there.
  • Teams set the defaults for some block types. Tasks are visible to the team, calls are shared to team memory unless a call is opted out, and emails flow into the CRM when Email Sync is enabled for that company.
  • Team roles are Member, Admin, and Owner. Only owners can invite and remove members.
  • Auto-join on domain, when an admin enables it, adds anyone who signs up with an email on the owner's domain to the team.
  • Public links make a document readable by anyone with the URL, including people without a Kuuumba account.

Kuuumba does not store passwords. You sign in with Google, with Apple on iOS, or with a one-time link sent to your email. Signing in with Google means your Google Workspace policies — two-factor authentication, session length, and device restrictions — apply to Kuuumba. Revoking Kuuumba's access from your Google account, or disconnecting it in Settings → Connections, ends email sync.

Agents and your data

Agents operate on your workspace data under the following guarantees:

No training on your dataYour content is never used to train models, ours or anyone else's.

Zero data retentionWe hold zero-retention agreements with our model providers, so prompts and content aren't retained on their side.

Agents inherit your permissionsAn agent can reach only what you can reach. Content that isn't shared with you isn't in your agent's context.

You choose the connectionsConnectors and MCP clients are opt-in per workspace from Settings → Connections.

Kuuumba routes requests to model providers including Anthropic and OpenAI, depending on the task. Data you send to a third-party MCP server that you connect yourself is governed by that provider's terms, not ours.

Retention and deletion

  • Deleting a block moves it to trash first, so it can be recovered.
  • Deleting your account is permanent. Settings → Account → Delete account removes your account and its associated data after a confirmation step.
  • Organizations can set a retention window that deletes documents and chats which haven't been accessed within a set number of days. Contact [email protected] to configure one for your organization.

Disconnecting a Gmail account stops future sync but doesn't delete mail that has already synced.

Report a vulnerability

Send suspected security issues to [email protected]. We pay bounties in accordance with the severity and impact of the finding.

Please include steps to reproduce, the affected surface (web, iOS, API, or MCP), and any accounts involved, and give us a chance to ship a fix before disclosing publicly. Because the codebase is open source, you can reference specific files or commits.

Don't file security issues on the public GitHub tracker. Use [email protected] so a report isn't visible before there's a fix.

FAQ

Is your data encrypted?

All data is encrypted in transit with TLS, and our databases, file storage, and backups are encrypted at rest with AES-256 using AWS KMS-managed keys.

Do you train models on my data?

No. We don't train on customer content, and we hold zero-retention agreements with the model providers we route to, so they don't retain it either.

How can I access, transfer or delete my data?

You can delete your account and its data from Settings → Account → Delete account. For a bulk export, or deletion scoped to part of your workspace, contact [email protected].

How do I keep my data in the European Union?

EU hosting is available on request. The default is AWS in the United States — email [email protected] and we'll host your workspace in an EU region instead.

How do I set up Kuuumba for HIPAA compliance?

For HIPAA compliance, we offer a Business Associate Agreement (BAA). Contact us at [email protected].

Who at Kuuumba can see my workspace?

Access to production data is restricted to the engineers who need it to operate the service, and infrastructure access is logged and monitored. We don't browse customer content, and support will ask before looking at anything specific to debug an issue.

Which subprocessors does Kuuumba use?

The hosted product runs on AWS. We sublicense LiveKit for video calls, FusionAuth for authentication, and PostHog for product analytics, alongside the model providers described above. Email [email protected] for the current list as part of a vendor review.

Does Kuuumba support SAML or SCIM?

Not yet. Sign-in today is Google, Apple on iOS, or a one-time email link, so Google Workspace policies are the practical enforcement point. If you need SAML or SCIM, let us know at [email protected].