Kenlode Sales Request a pilot

Security & IT

Your server. Your AI key. Your rules.

Kenlode Sales runs on infrastructure your company controls. This page is for the IT and security people who will review it: what runs, what leaves your network, and what we don't do yet.

What runs on your server

The Team Edition runs with Docker Compose on a server or virtual machine you provide. It has four services:

  • the application;
  • a PostgreSQL 16 database;
  • a Caddy proxy that terminates HTTPS;
  • a scheduled backup service.

Only the proxy listens on ports 80 and 443. The database is never exposed outside the Docker network. HTTPS is required, with either an automatic Let's Encrypt certificate or a certificate you supply. There is no self-signed mode.

A team of 10 needs 2 vCPU, 4 GB of memory and 40 GB of disk. For your numbers, use the server sizing calculator.

What leaves your network

Nothing about your Accounts, contacts or users is sent to us. Outbound traffic is limited to:

  • Your AI provider. AI features run on your own key for Anthropic, OpenAI, or any OpenAI-compatible endpoint, including one you host. Calls go directly from your server to that provider, never through us. You choose the model and see the cost.
  • Our license server. It receives only your license key and a random value, and returns a signed answer. It's contacted at sign-in, when a rep login is created, once a day, and during updates. It logs the source IP address and the result of each check.
  • Container registries, when you install or update: the application image from GitHub Container Registry, and the database and proxy images from Docker Hub.
  • Let's Encrypt, if you choose automatic certificates.

There is no telemetry, analytics or error reporting, and the app loads no third-party fonts or scripts.

If our license server is unreachable, nothing stops. Signed-in users keep working, and new sign-ins continue for 14 days after the last successful check.

Who can see what

There are two roles, manager and rep. Each Account has an Account Team: one primary owner and any collaborators. Only the Account Team can read an Account's content. The manager reads an Account the same way, by joining its team, in the open.

  • The manager's rollup shows each Account's name, stage, health, MEDDPICC completeness, last activity, commitment counts and Signals. It never shows notes, transcripts or other free text.
  • To read an Account, a manager joins its Account Team. The join is recorded on the Account's Timeline and shown on its team card, where the reps see it. That's what we mean by "every look at a deal is on the record".
  • This is a promise kept by the record, not a wall. The manager administers the team, so they can also make themselves an Account's owner (recorded on its Timeline), or reset a rep's password and sign in as them. A reset is logged, signs the rep out of every device and leaves them unable to log in until the manager gives them a new password, so it can't happen quietly. Who manages the team is a trust decision for your company.
  • Facts the AI extracts from transcripts become Proposals that a person accepts or rejects before they're saved. So do the contacts, relationships, research, opportunities and commitments your own AI agents add.
  • The app never edits or deletes history; it only adds to the Timeline.

Whoever administers the server can read the database and its backups, as with any self-hosted system. That control sits with your company, not with us. With managed hosting, it sits with us, under a data processing agreement, on a server dedicated to your company.

Sign-in and stored secrets

  • Passwords are stored as salted scrypt hashes.
  • Sessions use HttpOnly, Secure cookies. Changing a password signs out your other sessions.
  • Failed sign-ins are rate-limited: 10 per 15 minutes per IP address and per username.
  • Your AI provider key is stored encrypted (AES-256-GCM).

Backups

The backup service writes a nightly PostgreSQL dump to a folder on your server and keeps 14 days by default. A restore script is included, and every update takes a dump first. Copy backups off the server to suit your own policy.

What we don't have yet

We'd rather you hear it here than in a questionnaire:

  • No single sign-on (SAML or OIDC) and no multi-factor authentication.
  • No password complexity policy.
  • No in-app data export or deletion. You hold full database dumps; Accounts and users are archived, not deleted.
  • No encryption at rest beyond the AI key. Use disk or volume encryption on the server if your policy requires it.
  • No log of who viewed which page.
  • No SOC 2 or ISO 27001 certification, and no third-party penetration test yet.

Need a security questionnaire answered? Email sales@kenlode.com.