Kora
Start free

Resources

How Kora protects your data

A plain account of what Kora does today. We list what exists and say clearly what we do not claim.

Start free See pricing
Quick answer
Kora stores your ticket and workspace database and your files in the EU (Cloudflare D1 and R2, EU jurisdiction). Access is controlled with six roles. API secrets are stored hashed, webhook secrets are encrypted with AES-256-GCM, and webhooks are signed. Kora does not claim SOC 2, ISO or similar certifications.

What you get

Stored in the EU

Your ticket and workspace database and your files are stored in the EU (Cloudflare D1 and R2, EU jurisdiction).

Six roles

Owner, Admin, Manager, Operations, Agent and Viewer limit what each person can do.

Hashed API secrets

API secrets are stored hashed, not in plain text.

Encrypted webhook secrets

Webhook secrets are encrypted with AES-256-GCM.

Signed webhooks and file links

Webhooks use HMAC-SHA256 and file links are signed and expire.

Portal data controls

Portal customers can download and delete their own data. Owners can export or erase on their behalf.

How it works

4 steps, no setup call.

  1. 1Choose rolesGive each person the minimum access they need.
  2. 2Use signed webhooksVerify the HMAC-SHA256 signature on every payload.
  3. 3Keep secrets safeKeep API keys and webhook secrets out of public code and shared documents.
  4. 4Check the status pageSee live availability at usekora.app/status.

Related

Common questions

Your ticket and workspace database and your files are stored in the EU (Cloudflare D1 and R2, EU jurisdiction). Kora AI sends the text it needs to an external AI provider.

Questions about security?

Write to founder@usekora.app, or start with 1,100 free credits.

Start free Try the calculator
No credit card Unlimited members EU-hosted No contract

$0.10

per ticket · unlimited members