Every control below is enforced in code and covered by tests. Where we do not hold something a regulated buyer needs, this page says so rather than leaving you to discover it in a questionnaire.
Last updated
Data handling
Everything a workspace creates belongs to that workspace. Conversations, transcripts, recordings, callers, tickets, knowledge and settings are written with the workspace they were created in, and there is no query in the product that can read across that boundary.
That separation is enforced twice, on purpose. Every database query in the application takes the workspace as its first required argument, and PostgreSQL row-level security policies refuse the read independently if it does not. One of those is a convention a developer could forget; the other is not.
Your data is not used to train anything. It is processed to answer the call in front of it, and then it is your record.
Encryption
In transit, TLS 1.3 only, with HSTS. Nothing about the platform is reachable over an unencrypted connection, including the media streams that carry call audio.
At rest, provider credentials and access tokens are encrypted with AES-256-GCM under a key the application holds and the database does not. A dump of the database therefore does not contain a usable credential for anything.
No secret is ever committed to a repository. The process validates its environment at boot against a schema and refuses to start when a required secret is missing or malformed, rather than starting and failing on the first request that needs it.
Retention and deletion
Recordings and transcripts have a retention period you set, and they are deleted when it expires — by a job that runs, not by somebody remembering. Different retention for recordings and for transcripts is a normal thing to want, and the two are set separately.
You can delete a conversation, a caller or a caller’s whole history on request, and the deletion propagates to the records attached to it rather than leaving orphans behind.
A full export of a workspace’s data is available on request, in a format you can actually read. Leaving is not made difficult.
Access control
People have roles, and a role decides what they can see and do. Every permission is re-checked on the server for every request — what the interface chose to show or hide is presentation, and is never the thing that stops an action.
Sign-in is rate limited per account and per address, two-factor authentication is available, and every privileged action is written to an append-only audit log with who did it, when, and what changed.
Kasper staff do not browse your workspace. Platform administration is a separate surface with its own roles, and anything it does that touches a customer workspace lands in the same audit log you can read.
Compliance posture
We do not hold SOC 2, ISO 27001 or a published penetration-test report, and we would rather say that on this page than have you find out in a questionnaire. What exists today is the set of controls described above, enforced in code and covered by tests, plus signed webhooks from every provider and dependency scanning that blocks a release on a critical vulnerability.
For a regulated buyer that is a starting position rather than an answer, and the honest thing to do is talk about what your own reviewers need. We will tell you what we have, what we do not, and what we would have to build — with dates rather than adjectives.
Sub-processors
Kasper uses a small number of third parties to deliver the service. Telephony and SMS are carried by Twilio. WhatsApp calls and messages go through Meta’s business platform, because there is no other way to reach WhatsApp. Card payments and subscriptions are handled by Stripe, and no card number ever reaches our systems.
Speech and language processing is performed by a third-party AI provider under a data-processing agreement. The provider is named in that agreement and in the sub-processor schedule we will give you before you sign anything; it is deliberately not exposed anywhere in the product itself, including in the API, because which model runs a call is a platform decision rather than a workspace setting.
The platform itself — the database, the queues, the recordings and the application — runs on infrastructure we operate. Adding a sub-processor is a change we tell existing customers about before it takes effect, not after.
Send us your security questionnaire.
We would rather answer it honestly and early than have it come back at the end. Tell us what your reviewers need and we will tell you what we have.