Security at Keito
Security at Keito
Last reviewed: 29 October 2026
Keito is operated by OSO DevOps Limited, company number 10889879, registered in England and Wales. This page explains our access controls, data handling, and how to contact us about a security concern. Our Privacy Policy and Terms of Service describe the applicable data-protection and service terms.
Report a security concern
Email support@keito.ai with the subject Security report. Include the affected product or URL, a description of the issue, the time you observed it, and steps that help us understand it. Please avoid including customer records in the initial report.
Do not send passwords, API keys, session cookies, authentication codes, or access tokens. Contact us before carrying out security testing; the restrictions in our Terms of Service continue to apply.
For an account you believe has been accessed without permission, tell us which account is affected and when you noticed it. Current service availability is shown on our status page.
Authentication and workspace access
Keito uses WorkOS for authentication. Workspace roles and permissions determine which records and actions an authenticated user can access. Keito checks workspace membership and permissions on the server.
Keito supports authenticator-based two-factor authentication. Workspace owners can require it for their members. Microsoft Entra SSO is also available for eligible workspaces; those workspaces manage multi-factor authentication with their identity provider.
When connecting an integration, use your own account and the access your workspace has assigned to you. Review the permissions requested by the provider before approving a connection.
Hosting and data locations
The following production configuration was checked on 29 October 2026:
| Service | Verified hosting and controls |
|---|---|
| Website and web application | Hosted in AWS London (eu-west-2). |
| Primary database and automated backups | Aurora in AWS London (eu-west-2), encrypted at rest, with 30-day regional automated-backup retention. Available encrypted automated snapshots were also verified in that region. |
| Uploaded files | The file-storage bucket is in AWS London (eu-west-2), with default AWS KMS encryption and public access blocked. |
| Application transactional email | Sent through Amazon SES in AWS London (eu-west-2). Authentication email is handled through WorkOS. Recipient email systems may process or store messages elsewhere. |
This regional configuration does not establish that all backup copies or all service providers keep data in the UK. Backup availability does not establish a recovery time or prove that a restore exercise has been completed. Bucket defaults describe the storage configuration, rather than an audit of every historical file.
WorkOS, Stripe, PostHog, Zendesk and Grafana, along with optional integrations you connect, may process data outside the UK. Their locations and handling depend on the service and applicable agreement. See Privacy Policy, Section 5 for provider roles and Section 6 for international transfers and safeguards.
AWS certifications do not establish Keito certification. Contact support@keito.ai for current procurement information or a security questionnaire.
Data handling
Keito’s website and web application use HTTPS. Our Privacy Policy, Sections 5 and 8 describes our service providers, security measures, and the circumstances in which people may access Customer Data. We do not routinely review Customer Data; access is limited to the purposes described in that policy.
We do not use Customer Data to create, train, fine-tune, evaluate, or improve generalised or shared AI or machine-learning models. When you choose to connect an external AI or agent service, its own terms and settings govern that provider’s handling of the information you authorise it to receive. Google Calendar data and data derived from those events are excluded from Keito’s AI-agent and MCP integrations.
Integrations, retention, and deletion
Connecting a third-party service authorises the exchanges needed for the features you enable. Disconnecting normally stops future exchanges; it does not automatically delete records already copied to Keito or the other service.
Our Privacy Policy, Section 7 sets out retention periods, including active account data, technical logs, and billing records. You can request account or workspace deletion and contact us about data-protection requests at support@keito.ai. A third-party provider may retain its own records under its own agreement with you.
Agreements and questions
Our Terms of Service provide for a Data Processing Agreement, available on request, when you use Keito to process personal data of third parties. Email support@keito.ai with the subject Data Processing Agreement to request it or to ask about a procurement or security questionnaire.
For personal-data incident notification and your data-protection rights, see Sections 8 and 9 of the Privacy Policy.