Germany
Main servers and database, hosted by Hetzner.
SecurityNow available
Where your data lives, and how it is protected.
Plain facts, as of November 2026. Our Privacy Policy is the authoritative text.
Encrypted
HTTPS in transit. AES-256 for stored files.
EU option
Pick an EU-only location for each file.
Nightly backups
The database is backed up, encrypted, every night.
Where data lives
Three places, named.
Servers and database
Hetzner, Germany.
Files
Cloudflare R2. You can choose an EU-only location for each file.
Our GPU computers
The ones we run ourselves are in Israel.
AI requests
The app asks first.
Outside providers
Some AI requests go to Google Vertex AI, or to RunPod GPUs that may be in other countries.
On your device
Features that run on your device send nothing to them.
Encryption and backups
In transit, at rest, and on file.
In transit
HTTPS/TLS between the apps and our servers.
At rest
Cloudflare R2 encrypts stored files with AES-256.
KolChat
Messages and calls are end-to-end encrypted, following the Signal protocol design.
Backups
Encrypted database backups every night. In a restore drill on 16 October 2026 the database was usable in 33 minutes. Drills have run monthly since 22 October 2026.
Organizations
Control for admins, privacy for members.
Roles and audit
Owner, admin, member, viewer. Audit log export for 12 months.
Devices
Sign out, lock or wipe a device from the admin portal.
Share links
Links shared by organization members expire after 30 days by default.
Private files
Admins see company spaces, never members' private files.
Providers we use
What each one is for.
Hetzner
Hosting, Germany.
Cloudflare
File storage and websites.
Sign-in and Vertex AI.
RunPod
GPU computing.
Firebase
Sign-in.
In place, and planned
In place
- Roles, audit export, device control and 30-day share links for organizations.
- Encrypted backups and monthly restore drills.
Planned, as of November 2026
- Two-step sign-in and single sign-on (SAML, OIDC).
- SOC 2: on our roadmap, Type I preparation under way.
Questions and answers
Where is my data stored?
Main servers and the database are in Germany. Files are in Cloudflare R2, with an EU-only option for each file. The GPU computers we run ourselves are in Israel.
Does an AI provider see my content?
Only when you use a cloud AI feature, and the app asks first. Features that run on your device send nothing to AI providers.
Are chats and calls private?
KolChat messages and calls are end-to-end encrypted. They have not yet been independently audited.
Can admins read private files?
No. Admins see company spaces, never members' private files.
Does KolHive hold a security certification?
Not yet. SOC 2 is on our roadmap and Type I preparation is under way. Some of our providers publish their own certifications; those belong to them, not to KolHive.
Is there two-step sign-in or single sign-on?
Both are planned. We will move them to In place when they are available.
Keep exploring KolHive
- BusinessA company space, roles, an admin portal and install at scale.
- Private AIA model on your own computer, files kept local, apps that ask first.
- Encrypted chatKolChat: chats, calls and meetings encrypted end to end.
- AI OSWhat an AI operating system is, and how KolHive works as one.
Security questions?
Write to us and we will answer.