---
title: "Security, privacy and data handling"
description: "K3X security at a glance: SOC 2 Type II, encryption, no AI training on your data, sub-processors, hosting, export and retention."
url: https://help.k3x.ai/en/articles/125-security-privacy-and-data-handling
collection: "Account, Team and Security"
updated: 2026-10-04
language: en
---

# Security, privacy and data handling

K3X security at a glance: SOC 2 Type II, encryption, no AI training on your data, sub-processors, hosting, export and retention.

A quick reference for evaluating K3X. For a security questionnaire, DPA or anything beyond this page, email `hey@k3x.ai`. Full legal documents are at `k3x.ai/legal`.

## Certifications and frameworks

-   **SOC 2 Type II** audited.
    
-   **GDPR**, UK GDPR, Swiss FADP and CCPA/CPRA. K3X acts as a processor or service provider for your customer data, does not sell or share it, and honors Global Privacy Control signals.
    
-   Standard Contractual Clauses cover international transfers.
    
-   Not for protected health information: K3X does not sign BAAs and is not a HIPAA tool.
    

## Encryption

All data is encrypted in transit (TLS) and at rest (AES-256). Designated sensitive fields get field-level encryption in the database. Call recordings are stored encrypted.

## Your data and AI

K3X does not use your customer data to train its own foundation models or the models of its AI sub-processors. Agreements with AI providers, including OpenAI and Anthropic, prohibit them from training general-purpose models on data sent through the API. K3X's AI learns only inside your own account, and nothing is shared across accounts.

## Access control

-   Four roles: Owner, Administrator, Sales Manager, Sales Representative. Sales Representatives see only assigned records.
    
-   Role-based access, least privilege and multi-factor authentication for K3X administrative access.
    
-   Claude and ChatGPT connections are scoped per member and can be revoked at any time in **Settings → Authorized Apps**. Administrators can revoke other members' connections.
    

## Hosting and sub-processors

K3X is hosted in the United States. Sub-processors include Google Cloud Platform and Firebase (infrastructure, auth, storage), OpenAI and Anthropic (AI), Tavily (web search for agents), LangSmith (agent observability), Twilio (SMS, voice, phone numbers), SendGrid (email delivery), Google APIs and Microsoft Graph (connected mailboxes and calendars), and Stripe (payments). The current list is in the Privacy Policy at `k3x.ai/legal`.

## Your accounts, your channels

-   Email sends through your own connected Gmail or Microsoft 365 mailbox, never from a K3X address.
    
-   Payment card details are collected and processed by Stripe. K3X does not receive or store full card numbers.
    
-   Calls and texts run on Twilio numbers that belong to your workspace. You are responsible for call-recording consent and TCPA and CAN-SPAM compliance for your outreach.
    

## Export, retention and deletion

-   Exports are unlimited while your account is active.
    
-   After termination you have a 30-day window to export your data.
    
-   Account data is kept for up to 90 days after termination. Customer data is deleted within 60 days (the DPA targets 30). Logs are kept 13 months and billing records 7 years, as required.
    
-   To delete your account or request a data export, email `hey@k3x.ai` from the account's email address.
    

## Who can use K3X

Users must be 18 or older. K3X is built for business use with US business data.

## Related

-   Roles and permissions: Owner, Administrator, Sales Manager, Sales Representative
    
-   Profile, password and sign-in security
    
-   Is K3X down? Incidents and what to do