Aligned
ISO 27001
Our information security practices are aligned with ISO/IEC 27001:2022, covering policy, risk management, asset management, access control and incident management.
Trust and Security
Security built into how we build and run every agent.
Klivo is built for teams in regulated industries. This page describes what is in place today, in plain language.
Security at a glance
- Penetration test
- October 2026, all findings closed on retest
- Data residency
- India, including India-hosted AI models
- Encryption
- TLS 1.2+ in transit, encrypted at rest
- Access
- Role-based, MFA for administrative access
- Frameworks
- ISO 27001 and SOC 2 aligned
Compliance and Frameworks
Aligned with the standards your teams expect.
We build to the requirements of the major security and privacy frameworks. Here is where Klivo stands today.
Aligned
SOC 2
Our controls are aligned with the SOC 2 trust principles of security, availability and confidentiality.
Designed to comply
DPDP Act, 2023
Designed to comply with India's Digital Personal Data Protection Act, including consent, purpose limitation and data principal rights. India data residency is available for deployments that require it.
Designed to comply
GDPR
Designed to comply with GDPR for EU and UK data subjects, with data processing terms and deletion controls.
BAA available
HIPAA
HIPAA-aligned deployments are available with a Business Associate Agreement.
Cloud infrastructure. Klivo runs on cloud infrastructure from established providers that hold independent ISO 27001 and SOC 2 attestations.
Data protection
How we protect your data.
The controls below are in place today and are reviewed as part of our ongoing security cycle.
Data protection
Encryption in transit (TLS 1.2 and above) and at rest. Sensitive personal data can be redacted or masked before it reaches AI models, configured per deployment. Each customer's data is logically separated.
Access control
Role-based access, least-privilege permissions and multi-factor authentication for administrative access. Access is reviewed regularly.
Data residency
Customer data can be stored and processed in India, including on India-hosted AI models, for every deployment that requires it.
Independent testing
Klivo undergoes independent web application penetration testing. Our most recent test was completed in October 2026, with all findings closed on retest.
Governance and continuity
A documented information security policy, risk assessment and risk register, asset inventory, business continuity and disaster recovery plan, and incident management plan, reviewed as part of our ongoing security cycle.
People and supply chain
Security awareness training for everyone on the team, confidentiality obligations in every employment agreement, and a maintained software bill of materials for our platform.
Incident response. If a security incident affects your data, we notify you without undue delay and within the timelines required by applicable law, and we work with your team through resolution.
Deployment options
Deploy where your security architecture demands.
Two deployment options on the same Klivo platform, scoped to your data governance needs.
Managed cloud
Klivo-managed deployment with logical tenant separation. The fastest way to go live.
Dedicated deployment
Isolated infrastructure for organisations with stricter data governance needs. Scoped for Enterprise engagements.
Responsible AI
Responsible AI isn't a marketing phrase. It's a spec.
Every Klivo agent is grounded in your approved content, tells users it is an AI, and hands off to a person when it should. Guardrails, escalation rules and logging are configured with your team for each deployment.
Security reviews
Running a vendor security review?
Email security@getklivo.com and our security team will work with your InfoSec and procurement teams directly.
Responsible disclosure
Disclose a vulnerability.
Found a vulnerability? Email security@getklivo.com. We acknowledge reports promptly and keep you informed through remediation.
Questions about our security posture?
Loop in your security and compliance leads. We can walk through our controls and answer technical questions directly.