Security and data
The questions asked before choosing a supplier, and Kedalia's answers, as the website gives them. The details, including the list of our subprocessors, are in the legal information.
On this page
Where is the data?
On servers located in France, with a French hosting provider, which we administer ourselves. Our subprocessors are listed in the legal information.
Who has access to it?
Only the users you invite into your applications. The Kedalia team does not access your users' data.
Depending on your tier, the Kedalia team does not see your applications either, unless you open the access for 72 hours so that it can help you: see Your team.
Is the data backed up?
Yes: every night, onto a second server in France. The backups go back as far as six months, and restoring them is tested.
And artificial intelligence?
You have the choice. By default, the assistant relies on the AI model of an American provider, listed among our subprocessors: your messages and the files attached to the conversation are then processed outside the European Union. On request, the assistant relies on an AI model hosted in Europe.
What the conversation's notice says
Above the message box, a notice reminds you in every conversation: “You are talking to an AI. Your messages and files are processed outside the EU by an American provider: include only the data you need.” If your organisation uses the model hosted in Europe, it says “in the EU by a European provider”. Its “Legal” link leads to the details, and “Close” hides it in this browser.
What you do not write to the assistant
The assistant needs no real data to build your application. Do not write or attach:
- real personal data: names, addresses, phone or social security numbers of real customers or employees;
- passwords, access keys or sign-in codes;
- whole confidential documents, when an extract is enough.
To show an example, take an extract of your spreadsheet and replace the names with made-up ones: the assistant understands just as well. The real data then goes into the live application, through your users, not into the conversation.
What is checked before going online?
The application's tests, and a search for secrets (passwords, access keys) in what was changed. Nothing goes online if the tests fail. The steps are described in Getting started.
The contracts
The terms of sale and the data processing agreement (article 28 of the GDPR) each have their own page: they are what your purchasing department will ask for. You accept them by creating your account.