Encrypted credentials
Anything that grants access to a third party is stored AES-256-GCM encrypted at the column level.
Scope: SIP trunk credentials, API keys, MCP server definitions and phone number credentials.
Trust Center
Your data stays yours
You remain the controller and we act as your processor. What that means in practice, contractually and technically, is set out here.
01Rights and obligations
What you can rely on
The commitments GDPR asks of a processor, and where to read them in full.
Data subject rights
When a data subject asks you for access, rectification or erasure, we support you with the technical means to answer. The data sits in your own workspace, where it can be found, exported and deleted.
Breach notification
If we become aware of a personal data breach we notify you without undue delay and within 48 hours at the latest, which leaves room inside your own 72-hour deadline under Article 33. We assist with your notification duties and with data protection impact assessments.
AI disclosure on the call
Callers are told in the greeting that they are speaking to an AI, as Article 50 of the EU AI Act requires. On EU accounts the opener is enforced: it cannot be switched off and cannot be talked over, not even by a misconfigured flow. What you choose is the wording, not whether it happens.
Consent to recording
In many jurisdictions, Germany among them, a call may only be recorded with the agreement of everyone on it. The flow editor has dedicated building blocks for that: recording can be started and stopped mid-call, so nothing is captured before consent is given and the consent itself is on record. Whether and how you use them is your decision.
02Technical measures
How the platform is secured
The technical and organisational measures of Article 32, as they are implemented in the code.
Two-factor authentication
TOTP through any standard authenticator app, enabled per account.
Sessions: Short-lived JWTs, verified server side, with re-authentication forced on a permissions change.
Rate limiting
Sign-in, public forms and the external API each carry their own limits.
Purpose: Slows credential stuffing and caps the blast radius of a leaked API key.
Audit trail
Administrative actions and account-level events are recorded and reviewable.
Retention: Configurable, with a scheduled sweep so logs do not grow without bound.
Tenant isolation
Every query is scoped to its owner, and concurrency and quotas are capped per account.
Concurrency: One account cannot exhaust shared call or automation capacity at another account’s expense.
Encrypted in transit
All traffic to the platform and on to every provider runs over TLS.
Storage: Recordings and artifacts are stored in Frankfurt, with encrypted backups.
Where the platform runs
Application, database and recordings run on Google Cloud in Frankfurt, Germany.
Telephony: The SIP and media infrastructure stands separately, in a German data centre.
Retention periods
You set the period for recordings and transcripts, and nightly sweeps enforce it.
Platform logs: Event logs 90 days, captured request/response pairs 30 days, deleted automatically thereafter.
No model training
Your data trains no models, neither ours nor any provider’s.
At providers: Where a subprocessor offers a setting that would permit it, we do not enable it. That commitment is in the DPA.
03Data protection
How GDPR applies here
The split of responsibility and the contract that governs it, both in force from day one.
Regulation (EU) 2016/679 — the General Data Protection Regulation. The split of roles below, the processing agreement that governs it and the technical measures we take are all written against it. It is the standard this page has to be measured by.
You are the controller
You determine the purposes of processing. We process personal data only on your documented instructions, and never for our own purposes.
The DPA is already in force
Our Data Processing Agreement forms part of the terms under Article 28. There is no separate document to negotiate before you can start.
Confidentiality is binding
Everyone with access to personal data is bound to confidentiality, and access is limited to the people who need it to run the service.
Deletion or return at the end
When the service ends, personal data is deleted or returned, at your choice, unless the law requires us to keep it.
Contracting party and representation
Who operates the platform
Kilevel is operated by Socialz Systems Pte. Ltd., 68 Circular Road #02-01, Singapore 049422 (UEN 202336586M). The infrastructure your data sits on is separate from that, and stands in Germany.
EU representative under Article 27 GDPR
Visotask UG (HRB 279523), Kemptener Straße 31, 81475 Munich, Germany, is our designated representative under Article 27 GDPR and our European partner and distributor. Supervisory authorities and data subjects can address that establishment directly:
04Subprocessors
Who is involved in processing
The complete list, including the optional providers you can select for yourself.
| Subprocessor | Purpose | Processing region |
|---|---|---|
| Google Cloud | Application hosting, database, and storage of recordings, transcripts and artifacts | Frankfurt, Germany |
| Amazon Web ServicesOptional | Alternative cloud infrastructure. Primary hosting remains on Google Cloud | Stockholm, Sweden |
| Contabo | Telephony and SIP infrastructure | Germany |
| Cloudflare | Authoritative DNS, TLS termination, caching and the web application firewall in front of the site and the app; Turnstile human verification on public forms; sandboxes and browser automation for Work runs; mail routing on our own domains | Global edge network, EU and/or United States |
| Microsoft Azure | Language and decision models for voice, chat and Work runs | EU data zone |
| Deepgram | Speech to text, live and batch | EU endpoint |
| AssemblyAI | Speech to text for live calls, as a fallback transcriber or where selected | United States |
| ElevenLabs | Speech synthesis and speech to text | EU and/or United States |
| OpenAI | Language model for voice, chat and Work runs | EU and/or United States |
| Anthropic | Assistant and reasoning features outside the call path | EU and/or United States |
| xAI | Language model for the flow assistant, automations and call reasoning | EU and/or United States |
| Resend | Transactional email: account notifications, reports and alerts | United States |
| Stripe | Payment and subscription processing. Billing data only, never call content | Ireland and United States |
| SLNGOptional | Speech recognition, language and speech synthesis models, as an alternate route to providers including ElevenLabs | EU |
| MiniMaxOptional | Alternate voice, selectable per agent | EU and/or United States |
| SonioxOptional | Alternate live speech recognition, selectable per flow | EU and/or United States |
| TypeSafe AIOptional | Decision model for features selected per flow or automation | United States |
| TwilioOptional | Telephony carriage and SMS, with your own carrier account | United States |
| TelnyxOptional | Telephony carriage, with your own carrier account | United States |
| VonageOptional | Telephony carriage, with your own carrier account | United States |
The platform itself, the database and your recordings sit in Frankfurt, Germany, with telephony infrastructure in a German data centre. Where a provider is listed as “EU and/or United States”, processing may take place in either region, depending on the provider’s infrastructure and the feature in use. We use EU endpoints where they are available to us.
Optional means these providers are engaged only if you select them for your account. If you do not select one, it receives no data. With telephony carriers you connect your own account, so the carrier also acts under your own agreement with it.
A data processing agreement is in place with each of these providers. Transfers outside the EEA rely on Standard Contractual Clauses. Changes to this list are announced 30 days in advance, with a right to object — to be notified, write to [email protected].
05Your controls
What you control yourself
Four settings you can change without asking us first.
Export your data
Contacts, calls, transcripts and flow definitions export from the dashboard without a support ticket. The same export is your exit route: nothing has to be requested from us to leave.
Control retention
Recordings and logs are yours to keep or purge, on the period you set. Deletion reaches the storage bucket, not only the row that pointed at it.
Scope who sees what
Sub-users carry project-specific roles, and sensitive fields stay visible only to the people who need them.
Choose the disclosure wording
Pick from the built-in catalog across the supported languages, or write your own if your counsel prefers their phrasing. On EU accounts the wording is yours to set; whether the disclosure is spoken at all is not.
Security review
We answer security questionnaires and will walk your team through the architecture, availability, continuity planning and the exit route — including the outsourcing and audit rights your internal audit function needs. Send yours early in the process and procurement questions get settled before they start driving the timeline.