Kamflo

Trust & security

Security is part of the service.

Kamflo handles conversations, customer records, and connected services for the teams that use it. We take the responsibility seriously and work to protect the platform while being clear about what customers should do to protect their own workspaces.

Report a security concern

Our approach

Practical safeguards, clear responsibilities.

Security depends on both the platform and how each workspace is configured. These are the areas we focus on; we do not claim certifications or guarantees that are not stated here.

Protecting access

Kamflo uses authenticated accounts and workspace roles to control access to customer-support data. Workspace owners should grant permissions only to people who need them and remove access when roles change.

Connected accounts and keys

Integrations and optional bring-your-own-key features can involve credentials or API keys. Connect only accounts you are authorized to use, limit access at the provider where possible, and rotate credentials if you suspect exposure.

Data handling

Information is processed to deliver the features you choose, including support inboxes, widgets, AI agents, and connected channels. The vendors involved depend on your configuration; see our Privacy Policy for an overview of those data flows.

Account protection

We use measures intended to protect accounts and the service, including authentication and abuse-prevention controls. Keep passwords private and contact us promptly if you notice activity you do not recognize.

For workspace administrators

  • Use unique passwords and secure any third-party accounts you connect.
  • Review team roles and integration access regularly.
  • Only upload or sync information you are authorized to process.
  • Review AI-generated replies before they are sent to customers.

Report a vulnerability

If you believe you have found a security issue in Kamflo, please send a responsible, private report before sharing details publicly. Include the affected page or feature, the steps needed to reproduce it, and any relevant timestamps. Do not include real customer records, passwords, or API keys.

Email the security team

We will review reports and follow up when contact information is provided. This page does not create a bug-bounty program or authorize testing that could affect other users or service availability.