Security

Overview

Klientel is designed with security as a foundational principle. We invest heavily in infrastructure security, data protection, and compliance to ensure that your CRM data, call recordings, and customer information remain confidential, available, and protected against unauthorized access.

Infrastructure security

• Cloud hosting: Our platform runs on ISO 27001-certified cloud infrastructure located in the European Union with multiple availability zones for redundancy.
• Network security: Web application firewalls (WAF), DDoS protection, and intrusion detection systems are deployed at all network perimeters.
• TLS everywhere: All data in transit is encrypted with TLS 1.2 or higher. HTTP is automatically redirected to HTTPS.
• Backups: Automated daily backups with point-in-time recovery. Backups are encrypted and stored in geographically separate locations.
• Uptime: We target 99.9% uptime. Real-time status available at status.klientel.io.

Data security

• Encryption at rest: All stored data is encrypted using AES-256 encryption.
• Database security: Databases are not publicly accessible. Access is restricted to application servers via private network connections.
• Call recordings: Audio files and AI transcriptions are encrypted at rest and access-logged. You control who on your team can listen to recordings.
• Data isolation: Customer data is logically isolated; each account's data is stored separately with strict access controls.
• Deletion: When you delete data, it is removed from active systems immediately and from backups within 90 days.

Access control

• Multi-factor authentication (MFA): MFA is available and strongly recommended for all accounts. Administrators can enforce MFA for their team.
• Role-based access: Granular permissions let you control what each team member can view, edit, or export.
• Single sign-on (SSO): SAML 2.0 SSO available on Business and Enterprise plans.
• Audit logs: All significant account actions are logged with a timestamp and user identity. Audit logs are available in your account settings.
• Klientel employee access: Our engineers do not access customer data except as needed for support requests or with your explicit permission. All access is logged.

Compliance & certifications

• GDPR: Fully compliant. See our Privacy Policy and DPA.
• ISO 27001: Our information security management system is aligned with ISO 27001 standards.
• SOC 2 Type II: We undergo annual SOC 2 Type II audits covering the security, availability, and confidentiality criteria.
• Penetration testing: Independent third-party penetration tests are conducted at least once a year. Summaries available under NDA.

Incident response

We maintain a documented incident response plan. In the event of a security incident affecting your data:

• We will notify you within 72 hours of becoming aware of a breach
• Notifications will include the nature of the incident, affected data, and remediation steps
• Our security team is available 24/7 to respond to critical incidents

Responsible vulnerability disclosure

We run a responsible disclosure program. If you discover a security vulnerability in Klientel, please report it to us at [email protected]. We commit to:

• Acknowledge your report within 48 hours
• Keep you informed of our progress
• Resolve valid vulnerabilities within 90 days
• Not pursue legal action against researchers acting in good faith

Please do not publicly disclose vulnerabilities until we have had a reasonable opportunity to address them.

Contact our security team

For security questions, vulnerability reports, or to request our security documentation (SOC 2 report, penetration test summaries), contact us at [email protected].