Where is my data stored?

Kora runs entirely on Cloudflare's edge platform. Ticket data and workspace metadata live in D1, Cloudflare's European-region database. Uploaded files live in R2 object storage and are served through signed URLs that expire — nothing is publicly listable. Webhook secrets and API credentials are encrypted at rest (AES-GCM), and API keys are stored only as salted hashes.

Access model

• Every request is workspace-scoped — no query can cross workspace boundaries.

• Role-based access controls what each member can do; the public API key is the only non-member credential.

• Help-center analytics store only salted hashes of anonymous visitor IDs — never IP addresses.