Trust and data — for procurement

Quick answers for procurement

For an initial security and compliance evaluation — current state, stated plainly:

Primary infrastructure and data storage and processing run in the European Union. The app runs on Fly.io in Frankfurt (fra); data lives in AWS eu-central-1 (databases, files, queues) and Pinecone eu-central-1 (vector index). Meeting audio capture and transcription (Recall.ai, eu-central-1) and product analytics (PostHog EU cloud) also run in the EU. Transitional note: frozen US backups are scheduled for deletion by 2026-08-16.
What still processes in the US: LLM inference (OpenAI, Anthropic) under their commercial API terms, and transactional email (Resend) — see the sub-processor table below.
Retention and deletion: one policy per data type in the section below. The short version: meeting audio expires on its own (7 days at the provider); everything else is kept until you delete it, and deletion is real — cascading to facts, embeddings, files and the provider’s copy, out of backups within 35 days at most.
Recording consent documented — see Recording policy.
DPA: in preparation — email legal@kb2b.app for status and timeline.
Security call with a responsible party — request one by emailing legal@kb2b.app with subject “Security call”.

Retention and deletion

One policy, per data type. “Delete” means actually delete: the data leaves primary storage immediately and leaves backups by natural expiry, within 35 days at most.

Data	Retention	Deletion
Meeting audio — provider copy (Recall.ai)	7 days (168 h), automatic	Also deleted immediately when you delete the meeting
Archived audio and raw transcript (kb2b storage)	For as long as the meeting exists	Deleted when you delete the meeting
Documents, facts and embeddings	Until you delete them	Cascading: deleting a document or meeting erases its facts, their relationships and their vector-index embeddings
Chat history	Until you delete the conversation	Stored content is erased when you delete the conversation
Backups	Database replica: 24 h window. Files: backup versions of deleted objects expire after 30 days. Knowledge base: 35-day restore window	Automatic expiry — no indefinite copies
Usage events (internal telemetry, no document content)	90 days	Automatic expiry; only billing aggregates are kept
Account / workspace	While the account is active	Closure and erasure on request to legal@kb2b.app; self-serve full account deletion and data export are in development

Operational detail on meeting deletion in the Recording policy.

If you need more detail

Document	Availability
Data Processing Agreement (DPA)	In preparation — not yet available
Up-to-date sub-processor list	Available on this page (next section)
SOC 2 Type II report	Not started — kb2b runs on providers with their own certifications (AWS, Stripe); a kb2b SOC 2 is on the roadmap
Standard security questionnaire (CAIQ, VSA)	On request — we complete yours
Penetration test report	Not yet available — planned

Current sub-processors

All customer data flows go through the services below. The AI providers (OpenAI, Anthropic) do not train models on data sent through their APIs, per their commercial API terms; they may retain inputs briefly for abuse monitoring.

Sub-processor	Purpose	Customer data	Region	Transfer safeguard
Fly.io	Application hosting	All application traffic; kb2b database	EU (Frankfurt, `fra`)	DPA with SCCs · DPF active
AWS	Databases, file storage, queues, backups	Documents, transcripts, meeting audio archive, chat content	EU (`eu-central-1`)	DPA with SCCs · DPF active
Pinecone	Vector search	Fact embeddings and identifiers (no raw text)	EU (`eu-central-1`)	DPA with SCCs
OpenAI	Fact extraction, synthesis, embeddings	Document excerpts, facts, queries	US	DPA with SCCs · contract with OpenAI Ireland Ltd.
Anthropic	Chat answers and summaries	Questions, facts, transcripts	US	DPA with SCCs · contract with Anthropic Ireland, Limited
Recall.ai (Hyperdoc Inc.)	Meeting audio capture and transcription	Raw audio, transcripts (auto-deleted after 7 days on their side, and immediately when you delete the meeting)	EU (Frankfurt, `eu-central-1`)	DPA with SCCs
Stripe (Stripe Payments Europe, Ltd.)	Billing	Email, organization id	Global	DPA with SCCs · DPF active
Resend (Plus Five Five, Inc.)	Transactional email	Email addresses, login codes, invitations	US	DPA with SCCs · DPF active (EU/UK)
PostHog	Product analytics	Usage events tied to user identity	EU cloud (Frankfurt)	DPA with SCCs · DPF active

Sign-in uses Google or GitHub as OAuth identity providers (basic profile only).

Workspace isolation

Each kb2b workspace lives in its own POT (Knowledge Pot — the account’s knowledge container). POTs are isolated at the database level by workspace_id. There is no way for one workspace to query another workspace’s data — neither accidentally, nor via prompt injection.

Security contacts

General: legal@kb2b.app
Vulnerability disclosure: security@kb2b.app

DPA text in preparation; this page will link to it when available.

Concepts

Legal

Changelog

Trust and data — for procurement

Quick answers for procurement

Retention and deletion

If you need more detail

Current sub-processors

Workspace isolation

Security contacts

​Quick answers for procurement

​Retention and deletion

​If you need more detail

​Current sub-processors

​Workspace isolation

​Security contacts

Quick answers for procurement

Retention and deletion

If you need more detail

Current sub-processors

Workspace isolation

Security contacts