Security & Compliance
Enterprise-grade security,
startup simplicity
Koachly is built for healthcare, legal, and financial sales teams where security isn't optional. SOC 2 Type II in progress, GDPR compliant, and HIPAA-ready from day one.
Compliance
Built for regulated industries
SOC 2 Type II
Our SOC 2 Type II audit is underway. We're hosted on SOC 2-certified infrastructure and follow all controls for security, availability, and confidentiality.
GDPR Compliant
Koachly complies with GDPR. EU customers can request data export, deletion, and European data residency. We have a published DPA available on request.
HIPAA-Ready
HIPAA-aligned data handling for healthcare sales teams. Encryption, audit logs, and access controls meet HIPAA requirements. BAA available for enterprise customers.
CCPA Compliant
California Consumer Privacy Act compliant. California residents can request data access, deletion, and opt out of data selling. We never sell personal data.
Data handling
Exactly what we do (and don't) with your data
What we record
- ✓Call transcripts (text only, not audio)
- ✓Coaching scores and performance metrics
- ✓Talk-to-listen ratio and filler word counts
- ✓Personal Brain context you provide
What we don't record
- ✗Raw audio or video files
- ✗Counterparty personal data without consent
- ✗Payment card or financial account numbers
- ✗Data sold or shared with third parties
Data retention
- →Call transcripts: 90 days by default (configurable)
- →Coaching scores: retained for account lifetime
- →Personal Brain: retained until you delete it
- →Account deletion: all data purged within 30 days
Technical controls
Security built into every layer
AES-256 encryption at rest
All call transcripts, coaching data, and account information are encrypted at rest using AES-256. Encryption keys are managed separately from data.
TLS 1.3 in transit
All data in transit is protected with TLS 1.3. We do not accept connections over TLS 1.0 or 1.1. Certificate pinning is enforced in native apps.
Role-based access controls
Granular RBAC for owner, admin, manager, and member roles. Every API route enforces ownership checks. Cross-user data access returns 403.
SSO support (roadmap)
SAML 2.0 and OIDC single sign-on is on our roadmap for enterprise customers. OKTA, Azure AD, and Google Workspace integrations planned for Q2 2025.
Incident response
24-hour notification SLA for security incidents. We follow a structured incident response process with dedicated communication to affected customers.
SOC 2-certified infrastructure
Hosted on enterprise cloud infrastructure with SOC 2 Type II certification. We follow the principle of least privilege across all services.
FAQ
Security questions answered
Koachly is HIPAA-ready, meaning we follow HIPAA-aligned data handling practices including encryption at rest and in transit, strict access controls, and audit logging. Healthcare sales teams can use Koachly with confidence. Enterprise customers can request a BAA (Business Associate Agreement) by contacting our team.
Koachly's SOC 2 Type II audit is currently in progress. We are hosted on SOC 2-certified cloud infrastructure and follow all SOC 2 controls for security, availability, and confidentiality. Our certification report will be available to enterprise customers upon completion.
Koachly processes audio locally on your device for real-time transcription. Recordings are not stored by default. Managers reviewing call summaries only see transcripts and coaching scores — not raw audio files. You control your data retention settings in your account dashboard.
Koachly stores all customer data on enterprise-grade cloud infrastructure in the United States. EU customers can request data residency in European data centers. All data is encrypted at rest with AES-256 and in transit with TLS 1.3.
Responsible disclosure
If you discover a security vulnerability in Koachly, please email security@koachly.ai before disclosing publicly. We respond within 48 hours and credit researchers who help us improve.
Questions about enterprise
security?
Our team is happy to walk you through our security documentation, compliance posture, and data handling practices.