Security

KALK runs on recognized cloud providers in the United States, Canada and Europe. All communications are encrypted in transit (HTTPS/TLS). The full list of providers and locations is in our Privacy Policy.

Each organization's data is isolated from the others, and every access is checked on our servers. Within an organization, roles and permissions set what each member can see and do. Sign-in is handled by a specialized provider, and KALK never stores your password. Our staff access client accounts only when needed, through restricted access reserved for named people.

Payments are handled by Stripe, a PCI DSS Level 1 certified provider. Card numbers never reach our servers.

Your documents are analyzed through professional AI services, used only to produce your results. Our providers may not use your content to train their models, and we do not use your identifiable content to train ours.

Our changes go through code review and automated testing, and development, testing and production are kept separate. Secrets are never stored in our source code. The application database is backed up automatically.

If an incident affects your organization's content, we notify you without undue delay. When the law requires it, we also notify the Commission d'accès à l'information du Québec and the persons concerned.

Found a security issue? Write to us at info@kalk.ca. Please give us a reasonable time to fix it before disclosing it, and do not access other people's data.