KODAX

Data security

Your data. Securely hosted, clearly documented.

We build on a modern cloud infrastructure with EU hosting, daily automated backups and end-to-end encryption — and openly show what is standard and what can be added on top.

Learn more: How we work
Security setup

What every mandate gets today.

Standard setup

A solid baseline. No compromises on privacy.

Every project runs on a vetted cloud platform with European hosting, encrypted storage and automatic backups — no setup or extra purchase required on your side.

Pillars

What's included by default in every KODAX project

EU hosting

Database, file storage and backend run in EU data centres (Frankfurt / Ireland). Your data does not leave the European legal area.

Encryption

All data is encrypted at rest with AES-256 and protected in transit via TLS 1.2+. Passwords are only stored as bcrypt hashes.

Daily backups

The database is backed up automatically every day. Backups are retained for several days — accidental data loss can be rolled back to the previous day.

Row-level security

Every table is protected with fine-grained authorisation rules. Even with a bug in the code, no one can read data they are not entitled to.

Authentication

Login via email + password or Google. Session tokens expire automatically. No access without a valid sign-in.

Audited infrastructure

The platform is SOC 2 Type II and ISO 27001 certified, GDPR-compliant and continuously externally audited. You benefit at no extra cost.

AI without model training

We use AI providers (OpenAI, Anthropic, Google) only via their API under enterprise terms — your content is contractually excluded from training of public models.

Server-side API keys

All AI calls run through our backend. Provider API keys never sit in the browser, never appear in JavaScript and cannot be harvested by end users.

Minimal context to the AI

Only the fields needed for a specific task are sent to the model — not entire tables or dossiers. What doesn't need to leave, stays in your database.

Key figures

The most important facts at a glance

Hosting regionEU (Frankfurt / Ireland)
Backup frequencydaily, automatic
Backup retention≥ 7 days point-in-time
Encryption at restAES-256
Encryption in transitTLS 1.2+
Password storagebcrypt hash, never plaintext
CertificationsSOC 2 Type II · ISO 27001 · GDPR
Availability (platform SLA)≥ 99.9 %

Sources: current compliance documentation of the cloud platform we use. Original documents available on request.

In practice

What this means for you concretely

Your data lives in a professionally operated cloud environment — no Excel files on laptops, no unprotected servers. After a mistake we can restore yesterday's state, and sensitive information is protected at the database level even if an internal bug occurs.

  • Even accidental deletion can be rolled back to the previous day
  • Data does not leave the EU — no third-country transfer to the US
  • Access strictly per user and role, enforced inside the database
  • All connections encrypted, including between internal services
  • No unprotected plaintext passwords, no open endpoints

Questions about data security?

We're happy to draft an individual data-protection concept for your mandate — based on the standard setup, extended with the add-ons that make sense for you.

hello@kodax.ai