Trust & Security

What we collect, where it lives, and how we protect it.

Data we ingest

Server access logs from customer websites — user agent, path, timestamp, referrer, response status. Used to identify AI-agent visits and page-level engagement.
Google Analytics 4 (GA4) for the marketing site kachi.ai — aggregated, IP-anonymised, consent-gated. See the Privacy Policy and Cookie Policy.
Google Search Console (GSC) where a customer connects it — impressions, clicks, queries, top pages.
Contact-form submissions — name, work email, company URL, message. Stored to fulfil the enquiry.

All customer-facing production infrastructure runs in AWS us-east-1 (N. Virginia, United States).
Static site hosting: AWS Amplify. Edge routing: Cloudflare. Contact API: AWS API Gateway + Lambda. Log analytics: AWS Athena on S3.
Data is encrypted in transit (TLS 1.2+) and at rest (AWS-managed KMS).

Server access logs (customer): retained only as long as needed to produce the analytics we deliver, then aged out of the pipeline. Contact [email protected] for the current window.
GA4 (kachi.ai): retention is set on the GA4 property. See the Privacy Policy for the current value.
Contact-form submissions: retained for the life of the sales conversation, then archived. Ask [email protected] to have yours deleted at any time.
Visitor identifier (kachi_vid): up to 365 days on the visitor's device, revoked immediately if the visitor withdraws analytics consent.

GA4 traffic is loaded with anonymize_ip enabled — Google truncates the final octet before storage.
Server access logs may contain full IPs for a limited period for abuse and bot-detection purposes, then coarsened. Full details on request.

Amazon Web Services (AWS) — hosting, storage, compute, analytics (us-east-1).
Cloudflare — edge routing and DDoS protection for kachi.ai.
Google LLC — Google Analytics 4 (opt-in only). Google self-certifies under the EU-U.S. Data Privacy Framework.

The full sub-processor list, including any operational tooling in scope, is available under NDA — email [email protected].

In transit: TLS 1.2+ enforced on all public endpoints (kachi.ai, dashboard.kachi.ai, contact API).
At rest: AWS-managed KMS keys for S3, Athena results, and any persisted customer data.

A Data Processing Agreement is available on request for customers who need one under GDPR, UK GDPR, or comparable regimes. Contact [email protected].

Kachi's SOC 2 posture and any current audit status are shared with prospective customers under NDA. Email [email protected].

Security disclosures: see our security.txt or email [email protected].