Security

Updated October 15, 2026

Your data is walled off from every other company

Every query is scoped to your company by row-level security, enforced inside the database itself, not only in the app.
Roles are enforced in the database too. Owners and admins manage settings; agents reply; viewers can read but cannot reply or change anything.

Your AI provider key is stored encrypted in Supabase Vault. After you save it, Kerux only shows its first 8 characters.
Only owners and admins can add or replace it.
Ticket content goes only to the AI provider whose key you connect, under your own agreement with them. Until you connect a key, no ticket content is sent to any AI provider.
You decide what the AI touches: turn it off per inbox, exclude specific contacts, and set how confident it must be before it answers. Every AI action is logged on the ticket.

API keys are stored only as SHA-256 hashes. The full key is shown once, when you create it, and can be revoked at any time.

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
Kerux runs on SOC 2 Type II certified infrastructure: Supabase (database and login), Vercel (hosting) and Stripe (billing).
Card numbers are entered directly with Stripe and never touch Kerux servers.

Email support@kerux.io to export your company's data or delete it entirely.
If an account goes inactive, we keep the workspace for 12 months, email the owner 90 days before deletion, then delete it permanently.

No SOC 2 report of our own. The certifications above belong to our infrastructure providers.
No single sign-on (SSO) yet.
No full audit log of team actions yet. Changes to settings are logged.
We don't sign business associate agreements, so Kerux is not suitable for regulated health records.
No data processing agreement to countersign yet, and no choice of data region.

Kerux runs on Supabase and Vercel. If either is having an incident, you will see it here:

Email support@kerux.io with "Security" in the subject. More detail on data handling is in the Privacy Policy.