KesySecurity and data handling.
What we store, where it lives, who processes it, and how we protect it — in plain language.
What we store
- Your account and business details, and what you teach Kesy.
- For each call: the phone number, time, duration, recording, transcript and AI summary.
- Billing records and invoices.
Recordings and transcripts are visible only to your account. We do not sell your data or your callers’ data, and we don’t use your call content to advertise.
Where it lives
Our primary database is hosted in India (AWS Mumbai region).
How we protect it
- All traffic is encrypted in transit (HTTPS/TLS), and data is encrypted at rest by our database provider.
- Access to production systems is limited to authorised staff, and our admin tools separate each country’s customers.
- Card payments are handled by Razorpay; we never receive or store full card numbers.
- API keys for the Kesy API are issued per business and can be revoked; webhooks are signed so you can verify they came from us.
Sub-processors
We use these providers to run Kesy. Each processes data only to provide its service to us.
| Provider | What for | Location |
|---|---|---|
| Google Cloud (Gemini) | Real-time voice AI, transcription and summaries | United States / global |
| Exotel | Phone numbers and call connectivity in India | India |
| Supabase (on AWS) | Database and file storage | India (AWS Mumbai) |
| Railway | Application hosting | Cloud |
| Cloudflare | DNS, network security and email routing | Global |
| Razorpay | Payment processing (we never see full card numbers) | India |
| Brevo | Transactional email (receipts, alerts) | European Union |
| MSG91 / Meta WhatsApp | WhatsApp messages to you and your callers | India / global |
| Google Tag Manager, Meta | Website analytics and advertising (website visitors only, not call data) | Global |
Retention and deletion
We keep your data while your account is active. You can delete your account from your dashboard at any time — see Delete your account for exactly what is removed and what we must keep. Email support@kesy.ai to have specific call recordings and transcripts deleted.
Reporting a security issue
If you believe you’ve found a vulnerability, email support@kesy.ai with the subject “Security report”. Please don’t access other customers’ data or disrupt the service while testing.
We are a small company and don’t yet hold certifications such as SOC 2 or ISO 27001. If your business needs a security questionnaire answered, email us — we’ll answer it honestly.