---
title: "Security and Data Handling for Clients"
description: "Where client data is processed, which AI providers see it, how access works, which contracts we sign and how our controls map to ISO 27001 and SOC 2."
url: "https://kodokalabs.com/en/security-and-data-handling/"
language: en
published: 2026-11-09
updated: 2026-11-09
---

# Security and Data Handling for Clients

**In short:** kōdōkalabs does not use client data to train AI models. Confidential data can stay on self-hosted models in Germany if you choose that. Every piece of information is classified before it touches an AI system, and nothing goes live without human approval. When an engagement ends, we remove our access and return or delete your data within 14 days. A data processing agreement and a mutual NDA are standard.

This page is written for IT security leads, data protection officers, legal and procurement teams who review kōdōkalabs as a supplier. It covers client engagements. Last reviewed: 9 November 2026.

## How This Page Relates to Our Other Policies

- The [Privacy Policy](./privacy-policy.md) covers personal data of visitors to this website and people who contact us.
- The [AI Ethics & Safety Statement](./ai-ethics-safety-statement.md) sets out how kōdōkalabs uses AI: principles, data classes, model approval and human accountability.
- The [AI Transparency & Content Disclosure Statement](./ai-transparency-content-disclosure-statement.md) explains how we disclose AI-generated content.
- This page describes how we handle client data in engagements. Where an engagement contract says something different, the contract applies.

## Where Your Data Is Processed

The website, its server logs and all form submissions are hosted on kōdōkalabs' own servers in Germany, not on US cloud infrastructure. Our CRM, HubSpot, stores data in its EU data centre. Section 5 of the [Privacy Policy](./privacy-policy.md) has the details for website data.

In client engagements, where data is processed depends on the offer:

| Offer | Access we need | Where your data is processed |
| --- | --- | --- |
| Executive AI Marketing Assessment | Read-only access to analytics, Search Console, CMS and a view of your marketing technology; stakeholder interviews | kōdōkalabs workspace and approved AI tools, according to the data class |
| AI Search Visibility Audit | Your public website, read-only Search Console and analytics access | kōdōkalabs systems; no confidential client data is needed |
| AI Marketing Operating System | Build access to the marketing systems agreed in the statement of work | In your own environment where possible, otherwise in kōdōkalabs systems |
| Content Engine Build | Your content tools, brand material and briefs | Built in your own tools and accounts, so you own and run it after handover |
| Fractional AI Growth Director | A named account in your systems, like a team member | Your systems |
| AI Capability Academy | Your own workflows and sample material | Your environment, or anonymised examples |

**Self-hosted option.** You decide whether confidential data may be processed by external AI providers. If you choose self-hosted processing, kōdōkalabs processes it only with models we run on our own servers in Germany.

## How We Use AI With Your Data

Before any information is entered into, retrieved by or made available to an AI system, it is classified into one of four classes, each with its own rule. The full rules are in section 6 of the [AI Ethics & Safety Statement](./ai-ethics-safety-statement.md).

| Data class | Examples | Rule |
| --- | --- | --- |
| Public | Published webpages, public reports | May be used for an authorized purpose |
| Internal | Draft content, non-public processes | Only in an approved environment with a named owner |
| Confidential | Client strategy, commercial data, unpublished research | Only when you have authorized the purpose and the environment has passed review |
| Restricted | Credentials, special-category personal data, highly sensitive data | Not entered into any AI system without documented legal, privacy, security, contractual and technical approval |

- **No training on your data.** Data we send to the OpenAI, Anthropic and Google Gemini APIs is processed on paid business terms, under which the providers do not use it to train their models. The providers keep it only for abuse monitoring: typically 30 days, and up to 55 days for Google Gemini. Section 14 of the [Privacy Policy](./privacy-policy.md) states the same.
- **No reuse.** Your information is not used for unrelated training, demonstrations, marketing or benchmarking without an approved basis.
- **Approval per use case.** Models and vendors are approved for a defined use case, data class and configuration after a documented review, as described in section 7 of the [AI Ethics & Safety Statement](./ai-ethics-safety-statement.md).
- **Data minimization.** We use the smallest and least sensitive set of information that meets the purpose, and prefer pseudonymized, aggregated or redacted data where it does the same job.

## Access to Your Systems

- Access is limited to the people and systems that need it for the agreed task.
- We ask for read-only access wherever read access is enough.
- Access is granted to named people, not shared accounts.
- When an engagement ends, we remove our access and return or delete your data within 14 days.

## How Our Infrastructure Is Protected

- **Encryption at rest:** the disks of our servers are encrypted.
- **Encryption in transit:** all websites use TLS, and traffic between our servers runs over an encrypted private network.
- **Hardened containers:** the website runs in containers without extra privileges, with a read-only file system and resource limits, reachable only through a local reverse proxy.
- **Restricted deployment:** deployment keys can run one fixed deployment command and nothing else. Every production release is approved by hand.
- **Isolated build environments:** build and preview environments sit behind an egress firewall and cannot reach internal services.
- **Backups:** backups run on a schedule.
- **Logging:** system logs are kept for 14 days.
- **Rollback:** if a release fails its health check, the last healthy release is restored automatically.

We describe these controls in general terms on purpose. Details that would help an attacker are shared only in the Client Due-Diligence Pack.

## Subprocessors

| Provider | Purpose | Location and transfer basis |
| --- | --- | --- |
| Host Europe | Hosting and email | Germany |
| HubSpot | CRM | EU data centre |
| Kit | Newsletter | United States; EU-U.S. Data Privacy Framework or Standard Contractual Clauses |
| Google Workspace | Collaboration and documents | United States; EU-U.S. Data Privacy Framework or Standard Contractual Clauses |
| Google Gemini | AI models | United States; EU-U.S. Data Privacy Framework or Standard Contractual Clauses |
| OpenAI | AI models | United States; EU-U.S. Data Privacy Framework or Standard Contractual Clauses |
| Anthropic | AI models | United States; EU-U.S. Data Privacy Framework or Standard Contractual Clauses |
| AWS | Infrastructure for client work | United States; EU-U.S. Data Privacy Framework or Standard Contractual Clauses |
| Higgsfield | Video generation, only in engagements that include video production, agreed with you beforehand | United States; EU-U.S. Data Privacy Framework or Standard Contractual Clauses |
| Midjourney | Image generation, only in engagements that include image production, agreed with you beforehand | United States; EU-U.S. Data Privacy Framework or Standard Contractual Clauses |

Whether we use Higgsfield or Midjourney depends on the engagement. Which subprocessors an engagement actually uses is listed in its statement of work.

## Our Team

All 22 members of the kōdōkalabs team, contractors included, are bound by confidentiality agreements and receive the training their role requires, including training on AI use and data handling.

## Contracts We Sign

- **Data processing agreement:** where kōdōkalabs processes personal data on your behalf, we sign a data processing agreement under Article 28 GDPR. Our template is available on request.
- **Mutual non-disclosure agreement:** our standard mutual NDA protects both sides before and during an engagement. It covers the return or deletion of confidential information within 14 days and keeps confidential information out of AI systems that train on their input.
- **Ownership of deliverables:** you own the deliverables created for you once all invoices are paid. kōdōkalabs keeps its pre-existing know-how, frameworks, methods and tools, including the kōdōkalabs Transformation System and its supporting models, and may keep using general know-how gained in an engagement, never your confidential information.

## Incidents

If a security incident affects your data, we notify you without undue delay, and at the latest within 48 hours of becoming aware of it. To report a concern about security, data handling or AI use, write to info@kodokalabs.com. Section 15 of the [AI Ethics & Safety Statement](./ai-ethics-safety-statement.md) describes how incidents, errors and complaints are handled.

## Certifications and How Our Controls Map to ISO 27001 and SOC 2

kōdōkalabs holds neither an ISO/IEC 27001 certificate nor a SOC 2 report, and has not been externally audited. The ISO 27001 certificate of our data centre covers the data centre, not kōdōkalabs. The table shows which controls kōdōkalabs has in place that map to both frameworks.

| Area | Status | Evidence |
| --- | --- | --- |
| Information security and AI policies | In place | AI Ethics & Safety Statement, Privacy Policy |
| Information classification | In place | Four data classes with AI-use rules |
| Supplier and subprocessor management | In place | Vendor review per use case; subprocessor list |
| Confidentiality agreements and training | In place | All team members, contractors included |
| Access control and least privilege | In place | Named, need-to-know access; restricted deployment keys |
| Access removal, return and deletion | In place | Within 14 days after an engagement ends |
| Network security | In place | Encrypted private network, egress firewall, hardened containers |
| Encryption in transit and at rest | In place | TLS; encrypted server disks |
| Secure development and change management | In place | Reviewed changes, automated checks, manual release approval |
| Backup | In place | Scheduled backups |
| Logging | In place | System logs kept 14 days |
| Incident notification | In place | Without undue delay, at most 48 hours |
| Human oversight of automated actions | In place | Human approval before publishing and production actions |
| Physical security | Inherited | ISO 27001 certified data centre |
| Formal security management system (risk assessment, Statement of Applicability, internal audit) | Not in place | No formal ISMS documentation |
| External testing and audit | Not in place | No penetration test or external audit so far |

If your procurement requires a certificate or an audit report, tell us early. We will tell you honestly whether we can meet it.

## Request the Client Due-Diligence Pack

Organizations in a scoping conversation with kōdōkalabs can request the Client Due-Diligence Pack. It contains the data flow for each offer, the full subprocessor register, our infrastructure and security controls in detail, the full ISO 27001 and SOC 2 control mapping, our access, offboarding and deletion procedure, our incident response summary, our AI use policy and our contract templates. [Request the due-diligence pack](./contact-kodokalabs.md) through the contact page and mention the pack in your message.

## Frequently Asked Questions

### Do you use our data to train AI models?

No. Data sent to the OpenAI, Anthropic and Google Gemini APIs is processed on paid business terms, under which the providers do not train their models on it. Confidential data can also stay on our self-hosted models in Germany if you choose that.

### Which AI providers will see our data?

Only the providers approved for the data class and use case in your engagement: Google Gemini, OpenAI or Anthropic, or none at all if you choose self-hosted processing. Your statement of work lists the subprocessors your engagement uses.

### Can our data stay in Germany?

Yes, for confidential data. If you choose self-hosted processing, kōdōkalabs processes that data only with models running on our own servers in Germany. The website, its forms and our email are hosted in Germany in any case.

### Do you sign a data processing agreement?

Yes. Where we process personal data on your behalf, we sign a data processing agreement under Article 28 GDPR. Our template is available on request.

### Do you sign NDAs?

Yes. A mutual NDA is our standard before a scoping conversation or an engagement.

### Are you ISO 27001 or SOC 2 certified?

No. kōdōkalabs holds neither certification. The table above shows which of our controls map to both frameworks, and the Client Due-Diligence Pack contains the full mapping.

### What happens to our data when the engagement ends?

We remove our access to your systems and return or delete your data within 14 days.

### Who owns what you build for us?

You do, once all invoices are paid. kōdōkalabs keeps its pre-existing know-how, frameworks, methods and tools.