Your data is stored and processed in Canada. It does not leave the region as part of normal operation of the platform.

Primary storage and all replicas sit in Canadian regions. This includes customer content, account records, activity logs and audit trails.

Application processing, background jobs and search indexing run in the same region as the data they act on. Nothing is moved to another region for performance.

Backups are held in Canada, encrypted at rest, and restored only into Canadian regions. Retention follows the customer agreement.

Karos AI answers from your organisation's own content. Your content is not used to train shared or third-party models. Where inference is performed by a provider, it is under contract that prohibits training on your data and requires processing consistent with this page. Model selection is confidential and engine-agnostic.

We use a small number of service providers. Each is bound by contract to standards no less protective than our own, and the current list is shared on request under NDA as part of a security review.

Support staff access customer data only where a customer asks, only to the extent needed, and every access is logged. There is no standing access to customer tenants.

If we receive a request from a government or law enforcement body, we require lawful authority, disclose only what is legally required, and notify the affected customer unless prohibited from doing so.

We provide architecture detail, sub-processor lists and completed security questionnaires during the review process. Write to [email protected].