Security, privacy & compliance

Trust should be clear before your team connects its data

Review how Kandidly protects integration credentials, governs access, handles customer data, supports privacy reviews, and responds to security questions.

Start a security review Read the privacy policy

Security questions: security@kandidly.io

Encrypted

Integration credentials

OIDC

Organization sign-in

Auditable

Workspace activity

Controlled

Support access

Compliance posture

Security and compliance you can verify

Kandidly maintains the certifications, privacy frameworks, transfer mechanisms, and regulated-industry documentation teams need during security and procurement review.

Verified privacy framework

GDPR & UK GDPR

Kandidly supports GDPR and UK GDPR requirements through documented privacy rights, processor terms, retention practices, international-transfer controls, and data-subject request handling.

Available for customer review

DPA & subprocessors

Data processing terms, subprocessor disclosures, and customer review materials are available for teams evaluating Kandidly as a processor.

SOC 2 Type II

SOC 2

Kandidly maintains a SOC 2 Type II attestation covering the controls relevant to the trust, security, availability, and confidentiality of the service.

Verified certification

ISO/IEC 27001

Kandidly maintains ISO/IEC 27001 certification for its information security management practices, with supporting documentation available for enterprise review.

Verified privacy framework

CCPA / CPRA

Our privacy practices address California collection, disclosure, retention, access, correction, deletion, and opt-out considerations.

Verified privacy extension

ISO/IEC 27701

Kandidly maintains ISO/IEC 27701 privacy information management certification, extending the security program with controls for personal data stewardship and accountability.

Available for regulated reviews

HIPAA

Kandidly can support healthcare security and privacy reviews. Contact the security team to confirm the applicable service scope, safeguards, and agreement requirements.

Transfer mechanism available

EU Standard Contractual Clauses

EU Standard Contractual Clauses are available as part of the international data-transfer review for eligible customer arrangements.

Payment processing coverage

PCI DSS

Payment card processing is handled through Stripe's PCI DSS-covered infrastructure so Kandidly does not need to handle raw card details in the product.

Documented transfer practices

International transfers

Customer and personal data may be processed in the United States and other locations where providers operate. Review the privacy policy and contact us with transfer questions.

Data lifecycle

From collection to deletion, every step has a purpose

Your team should be able to explain what data enters the platform, why it is used, and how it is handled throughout its lifecycle.

What we process

Account and user details, workspace content, feedback, roadmap and release data, integration metadata, and service telemetry needed to operate and secure the platform.

Why we process it

To provide the product workflow, authenticate users, synchronize connected services, generate requested AI analysis, process billing, prevent abuse, and support reliability.

How long we keep it

We retain information only as long as needed for the service, account, legal, accounting, security, or operational purpose described in the privacy policy. Contact us about deletion and export.

AI processing

Feedback may be sent to Anthropic Claude for requested analysis. The privacy policy states that customer data is not used to train AI models and that AI features can be opted out of in workspace settings.

Security controls

Controls across identity, access, and operations

Integration credential protection

Integration credentials are encrypted before storage. Connected tools can be authorized without exposing credential values in the application.

Secure connections

Communication between your browser and Kandidly uses secure web connections. Outbound integration endpoints are validated before delivery.

OIDC single sign-on

Organizations can connect a compatible OpenID Connect provider and keep sign-in governed by their existing identity system.

Role-based access

Workspace roles and organization permissions help teams control who can administer settings and work with product data.

Auditability

Workspace activity is recorded with relevant context to support review, accountability, and operational investigation.

Support access controls

Platform support access is explicitly granted, logged, and time-limited so customers retain control over when support can access a workspace.

Tenant separation

Workspace data is organized by organization boundaries. Access checks are applied before customer data is read or changed.

Credential rotation path

Connected credentials can be replaced as provider permissions change or a customer wants to rotate access.

Review process

Bring us your questionnaire

If your team needs a DPA conversation, subprocessor review, security questionnaire, SSO discussion, or the current SOC 2 Type II and ISO documentation, send the request to our security team.

security@kandidly.io →

Security questionnaire responses

Privacy and processor review

OIDC and organization access review

Subprocessor and transfer questions

Common questions

Security FAQ

Need a current document or a specific answer? Contact security.

Is Kandidly SOC 2 certified?

Yes. Kandidly maintains a SOC 2 Type II attestation. Contact security@kandidly.io to request the current report and supporting documentation for your review.

How does Kandidly support GDPR reviews?

The privacy policy documents personal-data categories, purposes, processor relationships, international transfers, retention, access, correction, deletion, complaints, and marketing choices. Contact us for a review of your processing arrangement.

Where can I find the subprocessors?

The privacy policy includes the current documented subprocessor categories and providers, including Anthropic, Stripe, Sendbound, BetterStack, and Neon/PostgreSQL. Contact security@kandidly.io for questions about a specific provider.

Who can access our workspace?

Workspace access is organization-scoped. Customer roles control access within the workspace, and support access requires explicit customer grant, is logged, and is time-limited.

What happens when we delete or cancel an account?

The privacy policy explains that personal information is retained only as long as needed for the applicable purpose and may then be deleted or anonymized. Contact us to coordinate account export and deletion questions.

Can we use our own identity provider?

Yes. Kandidly supports OIDC single sign-on with compatible identity providers. Contact us if you need to review claims, provisioning, or organization access requirements.

Connect your product workflow. Start shipping products.

Kandidly gives your team one AI-powered home for feedback, features, roadmaps, and releases. Less overhead. More momentum.

Get started for free See pricing

The AI-powered product management platform for modern teams. Feedback, roadmaps, and releases — all in one place.

Utilities