Security and trust, by design.

Kong captures the customer conversations you choose to connect (email, calendar, meetings, and CRM) and turns them into prep, follow-ups, and next actions. Your data is in our care, and we built the product in Sweden with EU residency by default.

You remain the data controller. Kong acts as processor under our DPA and processes personal data only on your documented instructions.

• GDPR-aligned processing with a Data Processing Agreement in every customer contract.
• Recording notices and consent workflows built into the product. You decide what gets captured.
• Practices developed with the EU AI Act in mind: transparency, accountability, and risk management for AI features.
• DPA governed by Swedish law; disputes resolved per the commercial agreement.
• We follow ISO/IEC 27001 and SOC 2 control frameworks though we have not pursued formal certification yet.

Encryption

• TLS/SSL for data in transit.
• AES-256 (or equivalent) for data at rest.

Access

• Multi-factor authentication for access to sensitive systems.
• Role-based permissions so staff only reach what their job requires.
• Audit logging of access and material changes.

Infrastructure

• Hosted on Google Cloud Platform in Frankfurt, Germany (europe-west3).
• Network protections including firewalls, intrusion detection, and regular vulnerability assessment.
• Vendor management with security requirements for third parties.

Kong processes call recordings, transcriptions, email and calendar metadata, CRM data, and AI-generated outputs strictly to provide the service, not for our own unrelated purposes.

• Purpose limitation: we process data only for customer-defined use.
• No LLM training on customer content.
• Retention aligned to business need and your instructions; deletion or return on termination.
• Least-privilege access for sub-processors. Each system gets the minimum data required.

Kong uses the sub-processors below to run the service. We notify customers of material changes and apply the same protection standards through written agreements. Full legal entity details are in Appendix B of our DPA.

We primarily process personal data in the European Union. Production workloads run in GCP Frankfurt. When data leaves the EU/EEA, we use appropriate safeguards such as Standard Contractual Clauses or adequacy decisions including the EU-U.S. Data Privacy Framework where applicable.

Your role as controller

• You decide which conversations are captured and how outputs are used.
• You obtain necessary consents and inform meeting participants.
• You handle data subject requests; Kong assists where required.

Our role as processor

• We process personal data only on your instructions.
• We implement technical and organizational security measures.
• Our DPA reflects GDPR Article 28 processor obligations.

• Security whitepaperTechnical and organizational measures, encryption, access control, and governance.
• Data Processing Agreement ↗Processor obligations, sub-processors, and breach notification terms.
• Privacy Policy ↗How Kong handles personal data across the service.
• Terms of Service ↗Commercial terms and how the DPA forms part of the agreement.

• Formal incident reporting and response procedures.
• We notify affected customers without undue delay, no later than 24 hours after becoming aware of a personal data breach.
• Containment, root cause analysis, and stakeholder communication.
• Post-incident reviews to improve controls.

Security questions or document requests: team@saleskong.com.