Enterprise & Security
Enterprise answers, before the questionnaire arrives.
Review access controls, data handling, identity options and procurement documents for your institution. See what is implemented, what needs an approved setup, and what is still planned.
Security posture
Access controls your team can review.
Start with roles, workspace isolation, privileged access and audit records. Request current control evidence for your own review. Security practice register.
Reviewed access, private by default
New accounts start closed. Every application is screened when it arrives (bot protection, junk and throwaway-address filters, a risk score) and the applicant must confirm their email before anything opens. Whatever doesn't clear the screen is turned away or waits for a person on our team, and a suspended or rejected account is never reopened automatically.
Role-based access control (RBAC)
One identity opens role-scoped workspaces. Members, substitutes, librarians, personnel managers, artists, agents, presenters and admins each see only the records their role needs. Sensitive actions, such as exporting reports, need an explicit permission on top of the role.
A traceable record of key actions
Requests, holds, quotes, contracts, invoices, settlements, document opens, acknowledgements and admin actions are written to the audit log with who acted, when, on which record and what changed. Single sign-on and SCIM changes are logged the same way.
Multi-tenant isolation
Every protected endpoint checks ownership before it answers. A request for another workspace's record gets the same 404 as a record that doesn't exist, so nobody can probe for what is there. Lists only ever cover the caller's own workspace.
MFA on privileged surfaces
Admin dashboards need a valid session and a second factor. Sign-in is passwordless by default, by an emailed link. Single sign-on is available only to an approved organization, after testing with its own identity provider.
Rate limits + brute-force guards
Actions that change data are rate-limited per person, and the public contact form per IP address with a durable counter. Failed sign-ins are slowed and logged. The content security policy allows scripts only from a named list and blocks eval and framing; no advertising or cross-site tracking pixels load on the public site.
Enterprise identity
Single sign-on and SCIM, for approved organizations.
Both stay off by default. We switch them on one organization at a time, after that organization is approved and sign-in and provisioning have been tested with its own identity provider.
- Single sign-on for your organization
- Use your organization's identity provider to sign in to an existing Kalinklo account. Access stays closed until the organization's setup is complete and approved; SSO does not create new accounts.
- SCIM 2.0 provisioning
- Provisioning is scoped to your organization. Removing a person suspends their access while preserving their record history. Setup and testing with your identity provider are required.
- Approval and testing come first
- SSO and SCIM are not generally available. Configuring them is not enough: each organization is approved first, and sign-in and provisioning are tested with its own identity provider before anyone relies on them.
Data & privacy
Your data, your control — in and out.
Review export options, document deletion and published retention windows. Read the full policies: Privacy notice · Security practice register
- You own your data
- Your roster, relationships and records are yours. We do not sell or share contact data, and we never use it for marketing outside Kalinklo.
- Self-serve export
- Authorized staff can export workspace reports as CSV. Report exports have row limits and identify truncated results; use narrower filters when needed. Owners can also export core workspace records as JSON after a fresh MFA check. Document files are listed with permission-checked download links, not bundled into the JSON.
- Deletion on demand
- Workspace owners can delete vault documents on demand; superseded uploads are kept in the audit trail for integrity. Engagement business records carry legal retention obligations (below) and are handled accordingly.
- Retention, by record class
- Engagement records: life of the workspace + 7 years after closure (tax and legal). Vault documents: as long as the workspace exists, owner-deletable. Sign-in events: 12 months. Health checks record no personal data. The full table lives on /security.
- DPA: template now, countersignature on request
- A Data Processing Agreement template is downloadable right now (no request needed). For a countersigned copy for your organization, write to security@kalinklo.com. GDPR and HK PDPO are covered; the database is in the US (us-east-1) today, EU residency is planned, and subprocessors are published.
- No advertising or cross-site tracking
- No advertising or cross-site tracking cookies. When enabled, Vercel Analytics and Speed Insights provide cookieless, aggregate site measurements. See the privacy notice for data handling and the integration list for configuration status.
Integrations
Implemented, configured, or planned.
Integrated means implemented in Kalinklo. Configured means deployment settings are present; it does not prove a successful payment, delivery or provider health. Planned features are not available. Calendar feeds are one-way; provider e-signatures and two-way calendar sync remain planned. Integration status.
- VercelHosting, database & files
- Integrated
- Neon (Postgres)Hosting, database & files
- Integrated
- Vercel BlobHosting, database & files
- Integrated
- InngestHosting, database & files
- Integrated
- ResendEmail & forms
- Integrated
- Cloudflare TurnstileEmail & forms
- Integrated
- AirwallexPayments
- Configured
- Dropbox Sign / DocuSignContracts & signatures
- Planned
- Calendar feeds (.ics)Calendars
- Integrated
- Google CalendarCalendars
- Planned
- Outlook 365Calendars
- Planned
- SentryMonitoring
- Configured
- Vercel Analytics & Speed InsightsMonitoring
- Configured
AI safety
Drafts only. A human approves every commitment.
The same boundary is published on the AI policy on /security.
Drafts only — never an action
When AI is switched on, it may summarize or draft internal text. It may not sign contracts, send external messages, issue invoices, process payments, publish materials, or change settlement state.
A human approves every commitment
No message to the other party, contract, invoice or settlement change moves without a person confirming its exact content. The approval itself is audited: who clicked, when, on what.
Off by default, minimal context
AI stays off until an AI provider is connected. When it is on, prompts carry only the text being drafted, not your document library, and your data is not used to train models. Each run is logged: task, model, token counts and approval outcome.
Compliance status
Where we are on certification — honestly.
We do not yet hold SOC 2 or ISO 27001. We will not say otherwise. The controls those audits examine are live today and listed above. What follows is the certification path, stated as targets.
- SOC 2 Type IIn preparation
- Readiness assessment of point-in-time control design. We do not hold this certification today.
- SOC 2 Type IIPlanned
- A multi-month observation window evidencing controls over time — begins after Type I. The report most US institutions ask for. Not held today.
- ISO 27001Planned
- Stage 1 documentation review, then Stage 2 certification audit. The European procurement standard. Not held today.
- GDPR + HK PDPOAvailable now
- DPA template downloadable from the Trust Center; processor list published; US database region (us-east-1) today, EU residency planned.
The full roadmap with status notes is on Security practice register
Discuss support coverage, service-level terms, penetration-test evidence and residency requirements with the team. Confirm them in your institution's agreement; EU residency remains planned.
Procurement FAQ
Straight answers before the questionnaire.
The general FAQ covers pricing, visibility, and settlement on /faq. These are the buyer, legal, and IT questions.
Are you SOC 2 or ISO 27001 certified?
Not yet, and we will not say otherwise. The controls those audits examine — audit logging, tenant isolation, gated documents, MFA, defined retention — are live today and documented on /security. SOC 2 Type I is in preparation; SOC 2 Type II and ISO 27001 are planned.
Do you support SSO and SCIM?
Yes, for approved enterprise organizations. OIDC single sign-on and SCIM provisioning are switched on one organization at a time, after we have tested sign-in and provisioning with that organization's own identity provider. They are not generally available and stay off by default.
Can we get a Data Processing Agreement (DPA)?
Yes. The DPA template is downloadable right now — no request needed. For a countersigned copy for your organization, write to security@kalinklo.com.
Can we pay by invoice / purchase order?
Yes. Institutions can pay by invoice and bank transfer. We put your PO reference on the invoice, and the payment is recorded against it with a full audit trail. A card is not required.
Can we export — and delete — our data?
Owners can export core records as JSON after a fresh MFA check, with the export logged. Each record family is capped at 5,000 rows and the audit extract at 10,000; truncation is flagged. The document manifest links to permission-checked files. Full records and bulk files are available on request under the DPA. CSV reports also have limits. Owners can delete vault documents; business records follow the published retention windows.
Can we take payments and e-sign contracts inside Kalinklo today?
Payments: engagement invoices and subscriptions can be paid by card through Airwallex's hosted checkout where it is switched on; otherwise they are paid by bank transfer and recorded against the invoice. The current state is in the integrations list above. Contracts: every version is kept, previewed and downloadable in Kalinklo, signatures and the signed copy are recorded, and each step is logged. Signing through an e-signature provider is planned, not built.
How do we submit a security questionnaire?
Send it to security@kalinklo.com. Completed questionnaires come back with current control evidence; the same address handles DPA countersignatures and vulnerability reports, on the response timeline published on /security.
How is access granted — can anyone self-serve into our data?
No one reaches your data by signing up. Every application is screened and must confirm its email before an account opens; whatever doesn't clear the screen waits for a person on our team. Inside your workspace, your own staff decide who joins, through invitations and one-time access codes. Workspace records, member details and engagements stay behind sign-in.
Documents & links
Everything a reviewer needs, in one place.
The trust packet and DPA download right now, no request needed. The rest are the live pages behind each answer on this page.
English source documents dated 1 July 2026. The DPA is an unsigned template. Request current evidence and institution-specific terms before approval.
Diligence, answered
Security review should not start from a sales deck.
Start with the trust packet and DPA above. For vendor questionnaires, DPA countersignature, or institution-specific review, write to the office.