Data handling FAQ
Where is my data stored?
Workspace data is in PostgreSQL on Google Cloud SQL in us-central1; uploaded files are in Google Cloud Storage, US multi-region; the application runs in Google Cloud us-central1. All storage is US-hosted. Provider inference endpoints are not region-pinned.
Is anything trained on my content?
No. Model providers are used on API tiers that do not train on API content, and Kumkuat trains no models of its own. Standard provider API retention applies; a zero-data-retention addendum is not in place today.
What happens to a document I test once?
A quick reaction test on pasted or uploaded text extracts the text for that request only. Neither the document nor the reactions are stored. Narrative tests, chat attachments and library uploads are stored with their outputs, because you will want to come back to them.
Who at Kumkuat can see my workspace?
Workspace members you invite, and Kumkuat operators for support and incident response. Access by operators is logged.
How do I delete data?
Delete a document, persona, chat or report from the app and it is removed from the workspace. A workspace admin can also set chats, audience reactions and narrative test reports to expire automatically after a chosen number of days (Data retention). Ask your Kumkuat contact to delete a whole workspace, including its files and backups, on the timeline agreed in your contract.
Which third parties are involved?
Google Cloud hosts the platform. Google Gemini, OpenAI and Anthropic provide model inference; Sapling AI checks writing quality in content writing; Bright Data and Firecrawl retrieve public content; Alpha Vantage and Financial Modeling Prep supply press releases and transcripts; Twilio SendGrid and Loops deliver email; Slack receives digests if your admin installs the app. What each one receives, and a dated log of changes to the list, is on the Sub-processors page.
Does a persona chat question go to a public model?
Yes. Kumkuat first retrieves the most relevant excerpts from your workspace's own store, such as monitored sources, clipped content and the persona's linked knowledge bases. Those excerpts, the persona profile and the question are then sent to the configured model provider over the API. When the model is Google Gemini, Google Search grounding is also enabled so the model may run web searches derived from the question; other providers receive only the Kumkuat-retrieved context. Nothing is used to train the model. A workspace admin can switch web grounding off under Workspace settings → Policy. See Web grounding and Data flow.
Can I use my own model keys?
Yes. A workspace admin can add an OpenAI, Google Gemini or Anthropic key under Workspace settings → Models & provider keys. Once a key is saved, every call this workspace makes to that provider runs on your key and is billed to your account: chat, reactions, surveys, narrative tests, alert digests, and the background work such as document tagging, signal extraction and embeddings. Providers you have not added a key for keep running on Kumkuat-managed accounts. Keys are masked after saving and can be removed at any time. See Models and providers.
Do you offer single sign-on?
Yes. A workspace admin can connect your SAML 2.0 identity provider (Microsoft Entra ID, Okta, Ping, ADFS and others) under Workspace settings → Single sign-on, and can require it for your email domains once it is verified. People then sign in through your provider, with your MFA and conditional-access policies, and join the workspace automatically. See Single sign-on (SAML 2.0).
Can outputs be published automatically?
No. Reports, drafts and reactions are saved to the workspace. They leave only when a user exports them or creates a share link, which that user can revoke. Alert digests go only to the channels your admin configured.
What about compliance attestations?
Kumkuat does not currently hold a third-party attestation of its own; the infrastructure provider, Google Cloud, is audited (SOC 2, ISO 27001). See Compliance attestations. These pages describe controls, not certifications.