Security & compliance

Access control

• Workspace isolation — every record belongs to one workspace; only its members can access it. All API access is authenticated and workspace-scoped.
• Roles limit what members can do (see Roles & permissions). Placement fee figures and the Placement Finance dashboard are restricted to owners, admins and the Finance role.
• Email privacy is enforced per connected account, with three sharing levels and per-person grants (see Email privacy & sharing).
• Files (CVs, recordings, attachments) are served only via short-lived signed URLs to authenticated members.
• Emergency access — when someone is away and their inbox needs covering, an owner can let one member read a personal account for a set time, with a reason, under Emergency access in Settings → Security & data. Grants can be revoked at any time.

Two-factor authentication

Under Settings → Security, every member can set up an authenticator app (TOTP — Google Authenticator, 1Password, Authy or similar) with Set up, add a second device with Add device, or remove it.

Workspace admins set the rule for everyone in the Sign-in section of Settings → Security & data:

• Require two-factor — members without a verified authenticator app must set one up before they can use the workspace. Signing in through your identity provider (single sign-on) also counts.
• The same row counts how many members are enrolled; Show lists who is and who isn't.

When the workspace requires it, each member's own Security page says so.

Single sign-on

Kepler supports SAML 2.0 sign-in for an email domain, but it is not self-serve: Kepler configures the connection during onboarding. Send your identity provider's metadata URL and the email domain you want connected. You can enter both under Identity provider in Settings → Security & data and click Email support to send them. Once a connection is live, people with that email domain see Continue with single sign-on on the login page, the connection shows the role new members join with, and an admin can turn on Require single sign-on in the same section. Changes to a live connection also go through support.

Data protection

Your workspace's data and sign-in are hosted in Germany (EU), and files such as CVs and recordings are stored in the EU. Kepler is a Singapore company and some features use service providers in other countries; the privacy policy lists them and where they are.

Third-party credentials Kepler stores on your behalf — mailbox access tokens and webhook signing secrets — are encrypted at rest with AES-256-GCM under keys held outside the database.

For everything else, Kepler's published privacy policy is the authoritative statement: it says data is encrypted in transit and at rest, that Customer Data is not used to train AI models, and that Kepler complies with the PDPA and applicable UK/EU GDPR. Refer to the current policy for its exact wording.

• Payment details are held by our payment processor, not Kepler.
• See AI & data privacy for how AI features handle workspace content.
• Users with permission to delete activities can permanently remove a meeting's recording, transcript and minutes using Delete meeting data.

What deletion does

• A deleted candidate, contact, company, job or placement leaves active views, search and matching. The delete toast offers a 10-second Undo.
• After that, an admin can bring it back from Recently deleted (Settings → Security & data → Deleted records → Recently deleted → Open) with Restore.
• Deleted records are kept for the period set in Keep deleted records for (30 to 365 days), then removed for good.
• An owner can remove a record sooner with Delete permanently on the Recently deleted page, confirmed by typing its name — use this for erasure requests.
• Members can delete records — when off, only owners and admins can delete. Everyone can still edit.

Getting data out

Any record list exports to CSV or Excel from its Export menu, filtered and column-shaped as you have it on screen. For a workspace-wide export, an owner can click Request export under Data & closure in Settings → General; Kepler emails you when it's ready. For an export in a specific format, contact support.

Data subject requests

• Lawful basis & consent — use the native consent record to track purpose, lawful basis, source, dates and evidence for each candidate or contact. See Consent and GDPR records for setup and recording steps.
• Subject access & erasure — a candidate's record consolidates their data (profile, documents, communications) for access requests. For erasure, delete the record and have an owner use Delete permanently in Recently deleted; contact support for bulk compliance operations.
• The public portal collects only what applicants submit, protected against abuse (rate limiting, honeypot), and exposes advertised fields rather than internal CRM fields. Review advertised text for confidential information before publishing.

Your part of the bargain

• Remove leavers from the workspace promptly.
• Use conservative email sharing for mailboxes containing non-work content.
• Tell meeting participants when the Note Taker is covering a call, per local law — especially Zoom calls, where capture is native and no bot appears.