Your words, and the limits around them.
KORA holds the people you deal with and what they told you. This page states what we guarantee about that, who else is involved, and what we do not have yet. It does not describe how any of it is built.
Yours, and nobody else's.
Separation between accounts is enforced by the database itself, not by application code remembering to filter. Your uploads are private, and a link to somebody else's recording is not something you can reach.
No model trains on your data, and no human here reads your captures. Neither of those is a policy somebody has to remember: both are conditions of how the system is permitted to run at all.
Traffic reaches us over HTTPS only. Credentials are never in source control.
What we keep, and what we remove.
Your records, and a short processing record for each capture so a failure can be retried. On the free trial we transcribe a voice note and then remove the audio, keeping the transcript. On a paid plan, keeping recordings is off until you turn it on.
A free workspace that is never upgraded does not stay forever. We tell you what will happen and roughly when, we tell you again before the deadline, and upgrading at any point stops it. A paid workspace is on no such clock.
Deleting your account from Settings deletes it. That is immediate, and it is not reversible.
Export is a button, not a request.
From Settings you can take your contacts, companies, deals and interactions as CSV, or as a single workbook. There is no ticket to open and nobody to ask. It works on every plan, and it keeps working after a trial has ended.
The complete list of outside parties.
Every third party that touches your data or your account. There is no advertising network, no analytics vendor reading your records, and no data broker.
- Cloudflare
- Serves the application and runs the models that read your captures.
- Supabase
- Holds your records and the files you upload, and handles sign-in.
- Resend
- Delivers transactional email: invitations and account notices. It carries the message, never your records.
- Titan
- Receives mail sent to our published addresses.
- OpenRouter
- A standby model for the minutes when the primary is unavailable, held to the same no-train rule.
- Dodo Payments
- Takes payment. Card details go to them and are never sent to, or stored by, KORA.
- Sign-in: Google confirms your address, and KORA never sees or stores a password. If you connect Gmail, it carries the messages you send. Our waitlist and feedback forms run on Google Forms and Sheets, and the Android app is delivered and updated through Google Play.
- Microsoft
- Only if you connect Outlook: it carries the messages you send from KORA.
What we do not have.
None of the following exists today. They are listed rather than omitted, because a security page is worth exactly what its least honest line is worth.
- SOC 2
- There is no SOC 2 report. No audit has been performed.
- SSO and SAML
- Sign-in is Google, and only Google. There is no SAML, SCIM or directory sync.
- Data residency
- You cannot currently choose a region.
- A signed BAA or equivalent
- KORA is not set up for regulated health or payment data. Do not put it here.
If your organisation has a formal security review, tell us before you start a trial rather than after.
Write to us and a person will answer it. If we cannot do the thing you need, we will tell you that instead of scheduling a call about it.