Security & privacy

Every record — chats, projects, knowledge, keys, connections — is protected by row-level security in the database, so one account can never read another's data, even in the event of a query bug.

When you connect a tool (Google, GitHub, an MCP server, an n8n workflow), the access token is encrypted with AES-256-GCM before it's stored. The database holds ciphertext, never the raw token.

We store only a SHA-256 hash of your API key. The key itself is shown once at creation and cannot be recovered — if it's lost, you revoke and create a new one.

You can opt out of contributing your conversations to model improvement, and Incognito chats are never saved, remembered, or used for training at all.

The pay-as-you-go engine reserves and bounds the cost of every call before it runs, so a request can never cost more than your prepaid balance. Per-key rate limits protect against runaway usage.

Katalock's K-Computer answers each question several times over, independently cross-checks the results, and flags claims that aren't corroborated — reducing the confident-but-wrong failures that ordinary AI tools are prone to.

Your workflows, sequences, and marketing are private to your account (row-level security), and nothing is sent or posted on your behalf without your explicit approval. Outreach and posts go only to a webhook you configure, over HTTPS with basic protections against internal-address abuse, and inbound triggers are authenticated with a private token you can rotate at any time.

Authentication is managed by a dedicated identity provider — we never see or store your password. Sessions use secure, HTTP-only cookies, and connected-tool access can be revoked from your account at any time.

When you delete your account, your account and every piece of associated data — including your email — is permanently removed from our database. We retain nothing on our side, and it can't be undone. See the Privacy page for the full detail.

Katalock is built on established, independently audited cloud infrastructure — our database/authentication and hosting providers maintain SOC 2 compliance. Katalock processes data only with the vetted providers needed to deliver the service, each under data-processing terms and only for their part of the service. (SOC 2 compliance here refers to our infrastructure providers; Katalock has not undergone its own SOC 2 audit.)

Found a vulnerability? Email admin@katalock.net and we'll respond promptly. Please don't disclose publicly until we've had a chance to fix it.