> For the complete documentation index, see [llms.txt](https://docs.kiloiot.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kiloiot.io/trust-security-compliance.md).

# Trust and Security

Who runs Kilo, where it is hosted, its certification status, and quick answers for your security or vendor review.

Kilo is operated by CHIRP USA LLC and hosted on Hetzner cloud infrastructure in Germany. This section answers the questions a security or vendor review usually asks, and tells you what your own team needs to set up. The hardware store, Kilo Electronics, is a separate company and is not covered here.

## What does a vendor security review need to know about Kilo?

* **Where is the data hosted?** The September 2026 infrastructure checks found Kilo's cloud computing on Hetzner in Falkenstein and Nuremberg, Germany. Database, backup and provider-copy locations are confirmed on request for your service, and some features, such as the AI assistant and alert delivery, send data to other providers. Details: [Where Is Kilo Hosted?](/trust-security-compliance/infrastructure-and-subprocessors.md)
* **Who is responsible for what?** Kilo runs and protects the platform; your organization controls who has access, its devices and its local network. The full split and a setup checklist: [How Do I Secure My Kilo Deployment?](/trust-security-compliance/customer-security-guide.md)
* **Is there a data processing agreement (DPA)?** If you use Kilo to handle personal data, ask for one before that data goes in. It is completed for your actual service. What to send: [Does Kilo Sign a Data Processing Agreement?](/trust-security-compliance/processing-agreements.md)
* **Can we get our data out?** Yes, through the API or on request, and you can move to another provider. [How Do I Export My Data or Leave Kilo?](/trust-security-compliance/data-export-deletion-and-switching.md)
* **How does someone access or delete their personal data?** By emailing a privacy request. [How Does Kilo Handle Personal Data?](/trust-security-compliance/privacy-and-data-protection.md)
* **How do we report a vulnerability?** [How Do I Report a Kilo Security Vulnerability?](/trust-security-compliance/incident-response-and-vulnerability-reporting.md)

## Is Kilo ISO 27001 or SOC 2 certified?

No. Kilo is building and checking its information security management system, the policies and working controls that protect the service, against ISO/IEC 27001. Kilo does not currently hold an ISO/IEC 27001 certificate, a SOC 2 report, a BSI C5 attestation or a CSA STAR listing.

Hetzner holds its own certifications for its data centers. They cover Hetzner's services, not Kilo's application. When Kilo publishes an assessment, it will name the service assessed, the scope, the assessor, the date and any limits.

## Who do I contact?

Email **info \[at] kiloiot.de** (replace `[at]` with `@`) for security, privacy and contract questions. Leave passwords, private keys, camera footage and other people's personal details out of the first message; if they are needed, ask for a protected way to send them.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.kiloiot.io/trust-security-compliance.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.