Security: Data protection and personal information

Please use the recommended channels to report security issues, either phone or e-mail. Avoid reporting security issues via public channels.

Intro

Security of our customers' data is a main priority at Kundo. This document describes our security processes and how we work with security in general.

This document is updated whenever new security policies are added to our processes.

Note that individual customers might have additional safeguards in place as part of their agreement with Kundo. Text in a separate signed agreement supersedes this document.

For any security related question, contact security@kundo.se.

Data Protection and personal information

Data storage

All customer data is stored on Amazon's services, strictly within the EU/EEA. All access to Amazon is strictly made through encrypted connections.

The customer have ownership of all data that they have stored as part of the service. If the customer terminates its subscription with Kundo, the customer may request a full data dump in a standardized format from Kundo.

Upon termination of the contract all data on Kundos services that belongs to the customer will be deleted within 30 days. Within another 30 days all data is also removed from all backup systems. Note that the customer is responsible for managing data on external services (i.e. social media) where Kundo is not the main processor of data.

External data processors

As part of Kundo service, several data processors are used by Kundo. Before a new service is added its security implications for Kundo is carefully vetted, for instance regarding proper use of encrypted communication and data storage policies.

See the full list of external data processors that use customer data.

Personal information

Kundo stores personal information and is therefore subject to subject to GDPR and Swedish law (2018:218). Kundo is in compliance will all requirements following that storage.

Continued in Security: General security.