Security review for IT

How to use this page

You can use this page to answer a vendor security questionnaire for KolHive for companies, KolWrite and KolChat. Each section states how a protection works, who can see the data, and where the protection stops.

You can also check our published security page for live infrastructure details. If your security review asks a question that is not answered on this page, write to us at info@kolwrite.com.

Where data is stored and processed

We run our core infrastructure in Europe and Israel, and use named sub-processors for storage, sign-in and cloud AI.

Features that run directly on your device, such as on-device transcription, process data locally and do not send content to cloud AI providers.

Encryption in transit and at rest

Traffic to our servers and files at rest are encrypted by default. Only KolChat private messages, group messages and normal calls use end-to-end encryption.

For more detail on file storage and messaging keys, read how KolHive protects your files and KolChat end-to-end encryption.

Who can access your data

Because KolHive and KolWrite cloud files are encrypted at rest rather than end-to-end encrypted, our company can technically reach stored cloud data on the server.

Inside an organization account, company admins can see shared company spaces and never see members' private files. For example, if Maya Chen in Chicago is an organization admin, she can inspect folders in the company space, but she cannot open a team member's personal space.

In KolChat, staff and servers can never see private or group message text, photos, files, voice notes, call audio or video, meeting transcripts or your encryption keys. Our server does see routing and account metadata: who talks to whom and when, group names, group photos, group member lists and device IP addresses.

You can delete your recordings, files, chats and account at any time from the security settings inside the app or by emailing info@kolwrite.com. Your content remains stored until you delete it.

How AI features handle your content

Before an app in KolHive can use AI or internet access, it must declare that permission and show you a prompt stating the purpose and data use. When you choose your AI model and use features that run on your device, no content leaves your computer or phone.

When you send a request to a cloud AI feature, it runs on our own GPU computers in Israel or goes to the cloud providers named on our security page: Google (Vertex AI) and RunPod (GPU). Requests sent to Google Vertex AI or RunPod may be processed in other countries.

We do not use your content to train AI models. If that policy ever changes, we will update our Privacy Policy first and offer an opt-out. Records of AI requests on our servers are deleted 30 days after each request, or sooner if you delete the chat.

Admin controls and compliance status

The table below lists which organization security controls and compliance items are available today, in testing, or planned.

Software distribution and app permissions

IT teams can verify desktop installers when they install KolHive from our download page. The Mac direct download (DMG) is notarized by Apple. The Windows direct installer (EXE) is signed with a valid timestamped ITANU Authenticode signature.

Every app distributed through KOL Store declares the permissions it needs in a manifest. Sensitive permissions (files, camera, microphone, location, local network, Bluetooth, sensors, infrared, notifications, AI and internet access) display a purpose and data-use prompt before access is granted. Any call to an undeclared permission is refused, so apps that control hardware cannot access connected devices without prompting.