KesySecurity and data handling.
What we store, where it lives, who processes it, and how we protect it — in plain language.
What we store
- Your account and business details, and what you teach Kesy.
- For each call: the phone number, time, duration, recording, transcript and AI summary.
- Billing records and invoices.
Recordings and transcripts are visible only to your account. We do not sell your data or your callers’ data, and we don’t use your call content to advertise.
Where it lives
Our primary database is hosted in India (AWS Mumbai region). If you are in Canada, this means your data is transferred to and stored in India. Calls themselves are carried by Twilio, and voice AI processing is done by Google.
How we protect it
- All traffic is encrypted in transit (HTTPS/TLS), and data is encrypted at rest by our database provider.
- Access to production systems is limited to authorised staff, and our admin tools separate each country’s customers.
- Card payments are handled by Razorpay; we never receive or store full card numbers.
- API keys for the Kesy API are issued per business and can be revoked; webhooks are signed so you can verify they came from us.
- Calls carry a recording notice, and outbound calls enforce CRTC Unsolicited Telecommunications Rules calling hours and opt-outs.
Sub-processors
We use these providers to run Kesy. Each processes data only to provide its service to us.
| Provider | What for | Location |
|---|---|---|
| Google Cloud (Gemini) | Real-time voice AI, transcription and summaries | United States / global |
| Twilio | Phone numbers, call connectivity and call recording | United States |
| Supabase (on AWS) | Database and file storage | India (AWS Mumbai) |
| Railway | Application hosting | Cloud |
| Cloudflare | DNS, network security and email routing | Global |
| Razorpay | Payment processing (we never see full card numbers) | India |
| Brevo | Transactional email (receipts, alerts) | European Union |
| Google Tag Manager, Meta | Website analytics and advertising (website visitors only, not call data) | Global |
Retention and deletion
We keep your data while your account is active. You can delete your account from your dashboard at any time — see Delete your account for exactly what is removed and what we must keep. Email support@kesy.ai to have specific call recordings and transcripts deleted.
Reporting a security issue
If you believe you’ve found a vulnerability, email support@kesy.ai with the subject “Security report”. Please don’t access other customers’ data or disrupt the service while testing.
We are a small company and don’t yet hold certifications such as SOC 2 or ISO 27001. If your business needs a security questionnaire answered, email us — we’ll answer it honestly.