Built to SOC 2 controls from the first line of code
We are a young company, so we have not been audited yet. But Kentora is built to the controls an auditor checks, and each one is written down and tested.
A database for every business
Each business has its own Postgres database and its own login. That login can connect to nothing else.
AI that only sees one business
Every AI answer runs with that business’s own database connection. We record how many tokens it used, never what was said.
Strong passwords, slow to guess
Passwords are hashed with scrypt, common passwords are refused, and repeated failures lock the account for 15 minutes.
Two-step sign-in
Authenticator-app codes with recovery codes. Owners must turn it on once a second person joins the business.
Sessions that expire
Sign-in cookies are random, never stored in readable form, expire after 12 idle hours, and can be signed out everywhere.
Roles and permissions
Owner, manager, staff and viewer. Exports, deletion and role changes need an owner or manager.
Encryption, twice
Everything is encrypted at rest by Google Cloud. Connector passwords and WhatsApp tokens are encrypted again with a key unique to your business, held in Cloud KMS.
A full audit trail
Every sign-in, role change, connection and export is logged, and every record change keeps who, when, how, and what it was before.
Leave with everything
Download all your records and photos at any time. Close your account and we delete it all, including the encryption key, after 60 days.
Respect for your customers
WhatsApp messages only go to customers who agreed, never in your quiet hours, and “STOP” works immediately.
Verified webhooks
Every message from Meta and Stripe is checked against its signature before we act on it.
Careful changes
Every change to Kentora is reviewed and tested before release, and database changes only ever add, never remove.
Where it lives and who can see it
Your records are stored in Google Cloud in Sydney, Australia. Kentora staff only look at a business’s data when you ask us for help with it.
- Records: customers, products, invoices, payments, stock, in your own database
- Files: product photos and documents, in your own private folder, never public
- WhatsApp messages: in your database, with consent records for every customer
- AI: questions and data are sent to the AI provider to answer, and are not used to train models
- Billing: token counts and costs only, never the content
The companies that help us run Kentora
| Company | What they do | Where |
|---|---|---|
| Google Cloud | Hosting, databases, file storage, encryption keys | Australia (Sydney) |
| Anthropic | The AI models behind the agents and the Assistant | United States |
| Meta (WhatsApp Business Platform) | Sending and receiving WhatsApp messages | Global |
| Stripe | Card payments for subscriptions and AI credit (Australia, United States) | Global |
| PayHere | Card payments in Sri Lanka (planned) | Sri Lanka |
Start with Kentora Core. It’s free.
Assistant, Owner Brief, Kentora Records and one connected system.