Security
Where your data lives, who can read it, who processes it and the certifications it runs on, stated plainly.
At a glance
Where it lives
The database and files: Supabase in AWS Frankfurt, in the EU. The application: Vercel in London.
Who can read it
People in your organisation: the database filters every query to it. Kabaido staff are bound by confidentiality.
Who processes it
Supabase, Vercel, Stripe, Resend and Anthropic, each named in the data processing agreement, with notice before any change.
Certified foundations
Every provider we run on holds SOC 2 Type II; the database, hosting and AI hold ISO 27001 and payments run on PCI Level 1. Each is linked below.
Tenancy, in the database
Row level security, table by table
Every row carries its organisation, and a Postgres policy calling is_member returns only your organisation's rows, whatever the query asks.
Rows from two organisations in one table: the database policy returns only your organisation's rows, your files sit under your organisation's folder, and roles apply inside your organisation.
Customers read only their own
Customers who sign in to your customer surface are a separate principal, with policies of their own that return only their own records.
Keys reach one place
An API key is stored only as a hash and reaches one organisation. A station's device key reaches one station.
Background jobs, scoped in code
The few server jobs that run without a signed in user, such as billing webhooks and scheduled tasks, work on one organisation at a time.
Who processes your data
The five providers every workspace runs on, each with its own security page.
Supabase
AWS Frankfurt, in the EUHolds the database, sign in and file storage.
- SOC 2 Type II
- ISO 27001
Vercel
London, in the UKHosts the application and serves every page.
- SOC 2 Type II
- ISO 27001
Stripe
Takes payments and runs billing.
- PCI Service Provider Level 1
- SOC 2 Type II
Resend
Sends transactional and notification email.
- SOC 2 Type II
Anthropic
Runs the AI models behind every answer.
- SOC 2 Type II
- ISO 27001
- ISO/IEC 42001
Only once your organisation connects them: Google for Gmail inbox sync and Microsoft for Microsoft 365 inbox sync. Google also carries the meetings you book with us.
Anthropic's commercial terms say it may not train models on customer content from its services. Read Anthropic's commercial terms
Report a security issue to hello@kabaido.com and a person reads it.
Certifications as each provider's own page stated them on 23 September 2026.
Encryption and signing
In transit
TLS on every connection: Vercel serves the platform over HTTPS only, and Supabase encrypts traffic with TLS.
At rest
Supabase states AES-256 encryption at rest for the database and files it holds.
Your integration credentials
Encrypted again inside the application, with AES-256-GCM, before they are stored.
Signed webhooks
Every outbound webhook carries an HMAC SHA-256 signature of its timestamp and body, and is retried with backoff if your endpoint is down.