What data we collect, why, who we share it with, and your rights.
Kanonik is operated by Trust Helm LLC, organised under the laws of the State of Wyoming, United States of America (the "Provider", "we", or "us").
For questions about this policy, contact our privacy team at privacy@kanonik.ai.
This policy applies to personal data we collect through:
Two roles. When you visit our website or sign up as a Customer, we act as a controller for the personal data described below. When the Service processes Customer Data on behalf of a Customer (for example, names of internal compliance officers stored in your GRC tool), we act as a processor. The Customer is the controller of that data. Processor terms are set out in our Data Processing Addendum.
When you create an account or contact sales, we collect: name, work email, company name, role/title, country, and the GRC tool you use. For paid Customers, we also collect billing details (handled by our payment provider; see Section 6).
When you use the Service, we collect: your authentication identifiers (OIDC subject), the MCP tool calls your AI makes, the inputs and outputs of those calls, the Verifier's verdicts, approval-token references and approver identity, sync operations to your GRC tool, and the content of audit-log events (see Section 8 for retention).
The canonical representation of your GRC entities (controls, evidence, mappings, frameworks) and any personal data they contain (e.g., names of policy owners). We process this only to provide the Service to you. See the DPA for details.
If you email us, attend a call, or fill out a form, we keep records of those interactions (content, date, contact details) to provide support and to maintain a relationship history.
If we run analytics on this site, we collect aggregated, privacy-preserving usage signals (page visits, referrer, country at country-level granularity). We do not use cookies for advertising. See Section 11.
We use personal data to:
We do not sell personal data, train general-purpose AI models on Customer Data, or use Customer Data for advertising or profiling beyond providing the Service.
If you are in the EU, UK, or another jurisdiction with similar law, our legal bases for processing are:
For Customer Data we process on behalf of a Customer-controller, the legal basis is the controller's instruction (governed by the DPA).
We share personal data only with the categories of recipients listed below, and only to the extent necessary for the purposes set out in Section 4.
| Recipient | Purpose | Data categories | Location |
|---|---|---|---|
| Cloud hosting provider | Run the Service infrastructure (Kubernetes, object storage, networking) | All Service usage data + Customer Data, encrypted at rest and in transit | United States - see DPA Annex III for exact regions |
| Anthropic, PBC | Server-side Verifier LLM calls (rule-based + LLM cross-check before any commit) | Canonical entity excerpts and retrieved candidates; PII redacted at ingress | United States (Anthropic data-handling terms apply) |
| Payment provider (Merchant of Record) | Subscription billing, tax calculation, chargeback handling | Billing contact, company name, billing address, payment method (handled by provider) | Per provider's data residency terms |
| Email delivery provider | Transactional and approval emails | Recipient email and approval-token references; no GRC content | United States |
| Customer's GRC tool | Read and draft-write to your own GRC tool (e.g., Eramba) on your authority | Whatever you've stored there, accessed via the credentials you provide us | Wherever you host your GRC tool |
| Slack, Inc. (optional) | Approval-channel notifications, if your tenant opts in | Approval-token references; no GRC content | United States |
| Auditors, advisors, and counsel | Professional services, audits, legal compliance | As strictly necessary, subject to confidentiality | Various |
| Acquirer or successor | If we are involved in a merger, acquisition, or asset sale, your data may be transferred to the successor entity, subject to this policy | All data | Various |
An always-current list of sub-processors with versions and data-residency details is in DPA Annex III.
The Service infrastructure is operated in the United States. Where personal data of EU / UK / Swiss data subjects is transferred outside the EEA / UK / Switzerland, we rely on:
You can request a copy of the relevant transfer mechanism by emailing privacy@kanonik.ai.
We retain personal data only as long as necessary for the purposes for which it was collected, plus any period required by law:
Crypto-erase model. Each Customer tenant has a dedicated key encryption key (KEK). On deletion request and after a 30-day grace period, we destroy the KEK in our secrets vault. All data encrypted under that KEK becomes mathematically inaccessible. Append-only audit-log rows remain in the event store for the retention window above, but their canonical content is unrecoverable. This satisfies the GDPR Article 17 right to erasure for systems with append-only audit obligations.
We apply the technical and organisational measures described in DPA Annex II, including:
See the Security page for an overview and the DPA for the binding measures.
If you are in the EU, UK, or other jurisdictions with similar law, you have the right to:
California residents have the right to know what personal information we collect, to delete it, to correct it, to opt-out of sale or sharing (we do not sell or share personal information for cross-context behavioural advertising), and to non-discrimination for exercising these rights.
Residents of other jurisdictions (including Australia, Canada, Brazil) have similar rights under local law. Contact us using the details below and we will respond in line with applicable law.
Email privacy@kanonik.ai with your request. We will verify your identity, respond within the applicable statutory period (usually 30 days under GDPR; we may extend by two months for complex requests with notice), and confirm the action taken.
If you are an end user of a Customer organisation (for example, a compliance officer at a Kanonik customer), please contact your organisation first; we will support them in fulfilling your request as a processor.
The Service is intended for business use only. We do not knowingly collect personal data from anyone under 16. If you believe we may have collected data from a child, contact us and we will delete it.
We may update this policy from time to time. We will post the updated version at this URL with a new "Last updated" date. For material changes that affect your rights, we will give you reasonable advance notice by email or in-app notification.
For privacy questions or to exercise your rights:
If you are in the EU/UK and unhappy with our response, you have the right to lodge a complaint with your local supervisory authority. Lists are available at the European Data Protection Board and the UK ICO.