I
Who this page is for
This page is for the person who has to say yes. If you are a development finance institution, an investment fund, a research organisation or an NGO, the question is not whether Kofa sounds careful — it is whether you can put your session recordings and your decision context somewhere you can account for. This page answers that in the order a security review asks it.
The Data & Confidentiality page states the commitments in full. This page states the mechanism, and what we can produce as evidence.
Where we are honest about gapsKofa does not hold SOC 2 or ISO 27001 certification, and this page will not pretend otherwise. Section IX sets out what we do have, what we are pursuing, and when we expect to have it. A claim you can check beats a badge you cannot.
II
Where your data is hosted
Your organisation chooses the region its engagement data is hosted in. The choice is made once, when your workspace is created, and it applies to everything that follows: briefs, prep room records, session recordings, transcripts and decision assets.
Belgium — St. GhislainEuropean Union. Governed by the GDPR. Usually the right choice for European institutions and for anyone whose own obligations run to EU data protection law.
United Kingdom — LondonGoverned by the UK GDPR. For UK institutions and those whose contracting entity requires UK-resident data.
South Africa — JohannesburgGoverned by POPIA. For organisations that need data to remain on the African continent, and for clients whose own regulators prefer an African jurisdiction.
All three are Google Cloud regions, so the choice of region does not change the platform, the controls, or the sub-processors — only where the bytes and the backups live. Nothing is replicated between regions unless you ask for it.
Rollout statusRegion selection is being added to workspace creation. Until your organisation has selected a region, engagement data is hosted in Belgium — St. Ghislain, and any request to move it is honoured at no cost. Existing workspaces will be asked to choose when the selector ships.
III
Every read is logged
This is the control most platforms cannot show you, because reads are usually not recorded — only changes are. Kofa logs both.
What is loggedEvery read of a brief, a prep room record, a session recording, or a decision asset — by your team and by Kofa staff alike. An entry records who was granted access, which record, the moment, and the IP address and user agent the request came from.
Public share linksWhere access was granted by a share link rather than a person, the entry names the link. A recording opened by a forwarded link is attributable, not anonymous.
Append-onlyEntries cannot be edited or deleted through the application. What changed and who read it sit on one ordered history, so a record's life can be read end to end.
Refuse, don't skipIf an access cannot be written to the log, the read is refused rather than served unrecorded. A control that quietly records nothing when it fails is not a control.
Getting the logYour organisation may request the access history for any engagement. It is provided within five business days.
IV
Encryption, isolation and deletion
At restEngagement data is encrypted at rest with AES-256 using the storage provider's managed keys, rotated automatically. Customer-managed keys are available for institutions that require them.
In transitAll traffic between your browser, Kofa and our storage uses TLS 1.2 or higher. Connections offering less are refused.
Playback is capability-basedA recording is never served from a permanent URL. Playback is granted by a short-lived capability scoped to one recording — or to a single cite's window, where the consent was limited to a cite. A leaked link expires in minutes, and a revoked share link stops the underlying video segments, not just the page that listed them.
IsolationYour records are readable only within your organisation. Kofa staff access is need-to-know, tied to a specific engagement, and logged like any other read.
DeletionDeletion requests are confirmed within two business days and completed within ten. Deletion removes the record and its stored media; it is not a soft flag.
V
Session recordings, specifically
This is the artefact clients ask about first, so it gets its own section.
Where a session happensSessions run on Daily. It carries the audio and video for the duration of the call and is a sub-processor only for that window.
What happens at the endWhen the session closes, the recording is transferred to Kofa's own storage in your chosen region, and the copy held by Daily is deleted. Daily is not a long-term store for your recordings and we do not leave one with them.
TranscriptsProduced from the recording, stored in your region, and held to the same access, retention and deletion rules as the recording itself.
Purpose limitationA recording is used for one thing: producing your decision asset. Not product development, not quality scoring, not model training, not aggregated market analysis.
Deleting the recording, keeping the assetYou may keep the structured decision asset and delete the underlying recording and transcript. Retention is set per organisation, and can be set to the shortest period that suits you.
VI
Sub-processors
Named, with what each one touches and which region it operates in. This section is the source of truth; the list is updated before a sub-processor is used, not after.
| Provider | What it processes | Region |
|---|
| Daily | Session audio and video, during the call only. The recording is transferred to Kofa's storage and deleted from Daily when the session closes. | United States and EU |
| Google Cloud | Storage and hosting of recordings, transcripts, briefs and decision assets. Google does not access stored content. | Your chosen region |
| OpenAI | Ask Kofa and AI-assisted features. Queries are scoped to your organisation's own records and are not used to train models. | United States |
| EmailOctopus | Newsletter subscriptions only. No engagement data is sent to it. | EU |
PaymentsKofa does not yet process payments through a third party, and no card or billing data is collected. The payment provider will be named on this page before any client is asked for payment. Payment data is never a route to your engagement data.
We will give written notice before adding or replacing a sub-processor that touches engagement data, so you have the chance to object.
VII
AI and your data
Kofa uses AI to help retrieve and organise what is already in your records. It is never the authority on what is true, and it is never the authority on what is deleted.
Not trained onYour briefs, recordings, transcripts and decision assets are never used to train, fine-tune or evaluate any model — ours or a provider's. This is a contractual commitment, not a setting.
Scoped retrievalAn Ask Kofa query searches your organisation's records and nothing else. One client's data is never a source for another client's answer.
Human authority over deletionRetention and deletion are human decisions. No model may authorise, block or override the deletion of a record.
Sources stay attachedAn AI-assisted answer cites the records it drew on, down to the line in the transcript. Every Kofa summary is labelled as a summary and traced back to the practitioner's own words, which are never edited.
VIII
Recording is optional
A Kofa engagement does not require recording, and the platform is built so that declining one is a normal choice rather than a limitation of the product.
No-recording sessionsA session may run with recording switched off. The conversation still produces a structured record from the notes and the practitioner's confirmed contributions; there is simply no audio or video stored afterwards.
Who must consentEveryone in the room. The practitioner agrees before the session, and the client warrants that every person it brings — colleagues, advisers, observers — has been informed and consents to recording. Where any participant does not consent, the session runs unrecorded.
Consent is per engagementThe permissions that govern an engagement — recording, transcript, quotation, attribution, embargo, reuse — are recorded against the engagement itself, so the basis on which material exists is inspectable afterwards. Consent given for one engagement does not carry to the next.
Your choice, per sessionYour organisation can set a default: recorded, unrecorded, or decided session by session. The setting is yours to change, and it is enforced by the platform rather than by instruction.
IX
Assurance and disclosure
Certification
Kofa does not currently hold SOC 2 or ISO 27001 certification. We are not going to imply otherwise by burying it in a sentence about being "designed to comply". The controls above are implemented; the independent attestation of them is the next step, and our plan is to commission a SOC 2 Type I readiness assessment and then a Type II report. Institutional clients assessing Kofa now are offered the compensating evidence in section X.
Testing
We welcome adversarial testing of the platform and the API. We do not offer a bounty, and we will credit anyone who reports a vulnerability if they wish.
Reporting a vulnerability
Send reports to security@kofa.network, or follow the contact details in our security.txt. We will acknowledge a report within two business days and tell you what we intend to do about it. Please do not access, alter or exfiltrate data that is not yours, and give us a reasonable window to fix an issue before publishing it.
If something goes wrong
If an incident affects your engagement data, Kofa notifies affected clients within 72 hours of becoming aware of it — the nature of the incident, the data affected, and what we are doing to contain and remediate it. Notification is not contingent on a regulator requiring it.
X
What your reviewers can have
Ask for any of these at security@kofa.network or privacy@kofa.network, and you will have them within five business days — before you have committed to anything.
Data Processing AgreementProvided at no cost, mapped to the GDPR where your own obligations require it, and to the Nigeria Data Protection Act 2023 by default. Executed typically within five business days.
Sub-processor listThe current list with provider names, the categories of data each processes, their regions, and the change-notice terms.
Security questionnaireA completed response to your own due diligence questionnaire, or a standard set such as CAIQ or SIG Lite.
Architecture summaryA written description of where data flows, where it is stored, and how playback and access are gated — enough for your architects to challenge.
Access historyThe read and change history for any engagement, as described in section III.
A pilot on your termsAn unrecorded first engagement, under NDA, with retention set to the shortest period you allow — so the controls are exercised before you have to trust them at scale.