What Kaypo touches, and what it cannot.

Tenant separation

Two independent mechanisms, because one of them will eventually be forgotten.

Row level security

Every table carrying workspace data has row level security enabled with an explicit policy. A query that crosses workspaces is refused by Postgres, not by the application, so forgetting a filter returns nothing rather than everything.

Views run as the caller

Postgres runs a view as its owner by default, which skips the policies on the tables underneath. Every view Kaypo exposes sets security_invoker, so reading through one is governed by the same rules as reading the table.

Functions check the caller

Routines that run with elevated rights verify that the workspace id they were handed belongs to the session before returning anything, rather than trusting the argument.

The workspace id is never user input

No endpoint accepts a workspace id from a query string, a path segment or a form field. It is resolved from the session on every request.

Encryption

Stored credentials

CRM and Slack tokens are sealed with AES-256-GCM before they are written. A fresh 96 bit initialization vector per credential, a 128 bit authentication tag verified on every read, and a version byte on the envelope. Keys rotate without downtime: the previous key is accepted while credentials re-seal under the new one.

At rest

Postgres on Supabase, which encrypts the underlying volumes. Credentials are additionally encrypted by Kaypo as above, so the database itself does not hold a usable token.

In transit

TLS on every connection, including between Kaypo and your CRM.

What Kaypo can reach

Read is most of it. Write is narrow, deliberate and recorded.

Read

Deals and their stages, companies, contacts, activity timestamps, and the text of emails, calls and meetings attached to those deals. Scoring uses the buyer side of that text; what your own people wrote is discarded before matching.

Write

A score, and an edit you make inside Kaypo, back to HubSpot, Salesforce or Attio. Nothing is written that you did not change. Every write is recorded.

Never

Kaypo does not email your buyers, does not create or move records on its own, and never uses one workspace’s data to score another’s. No model provider receives your deal text.

Access and accountability

Authentication

A signed link to a verified address. No password exists to be reused, phished or leaked. Session cookies are HTTP-only, secure and SameSite=Lax, and carry a signed issue time the server checks, so a captured cookie expires rather than working indefinitely.

Roles

Owner, admin and member. Connecting a CRM, inviting a person, importing a file, issuing an API key and deleting the workspace are restricted to admins. Only the owner can delete the workspace.

Connecting an integration

OAuth state is HMAC-signed and bound to the browser that started the flow by a single-use nonce, compared in constant time. The person completing the flow must be an admin of the workspace that started it.

Audit log

46 distinct actions are recorded with actor, target, timestamp and the address that performed them, including every connection created or revoked, every API key issued or revoked, every scoring weight change, and workspace deletion.

API keys

Displayed once, stored only as a hash, scoped to a single workspace, revocable immediately, and rate limited at 600 requests an hour per key rather than per workspace, so one integration cannot exhaust another.

Abuse limits

Sign-in links are limited per address and per source independently. Imports, exports, invitations and connection attempts each have their own hourly ceiling.

Retention and deletion

Export

Every table your workspace owns, as JSON, from the settings page, at any time, without asking us. Deals alone are also available as CSV.

Disconnecting

The stored credential is erased immediately. The data it produced is scheduled for deletion 30 days later, so an accidental disconnection can be undone without re-syncing your history. Reconnecting inside that window cancels it.

Deleting the workspace

Every table referencing the workspace is removed by database cascade: deals, scores, history, signals, rules, keys and credentials. There is no archived copy and support cannot restore it.

Subprocessors

The complete list, not the convenient one.

Vercel

Application hosting and edge delivery.

Supabase

Postgres database and authentication. Your pipeline data lives here.

Your own tools

The CRM, Slack workspace and call recorder you connect yourself. Kaypo reads from them under the access you grant and you can revoke it at any time.

Page analytics are aggregate and cookieless and never receive pipeline data. You can exclude your own browser entirely at no-track.

What Kaypo has not done

You would find this out in four minutes. Better that you find it here.

• No SOC 2 report.
• No third party penetration test.
• No contractual uptime commitment and no public status page.
• No single sign-on or SCIM provisioning.
• No customer-managed encryption keys and no choice of region.

Kaypo is early and claiming otherwise would be the first thing you discovered was untrue. If your process requires any of these, say which and where you are in it, and we will tell you plainly whether we can meet it rather than writing a roadmap at you.

Reporting something

security@kaypo.io reaches a person, not a queue.

If you have found something real, you will have confirmation within one business day and a note on what is being done. Testing against your own workspace is fine and we will not threaten you for looking. Please do not test against anybody else’s.

Related: privacy policy, terms, and how the scoring works.