Your pipeline is the business. Here is how we keep it.
Plain answers to the questions a careful buyer asks: who can see my data, how is it stored, what happens if I leave, and what can the AI connection actually do.
Workspace isolation
Every record carries your workspace's identity and every query is scoped to it. There is no shared view across customers, and nothing in another workspace can reach yours.
Encrypted credentials
Third-party keys you connect — your dialer, mail, skip-trace or AI accounts — are stored in an encrypted vault, with a separate encryption key derived per workspace. Keys are never shown back in full.
Two-factor sign-in
Text-message codes on sign-in. A phone is only trusted after it proves a code, and changing or disabling the factor requires the account password, not just an open session.
In transit
Everything between your browser, the mobile app and Kernalite Cloud runs over TLS with a managed certificate. Mail you send through your own mailbox goes out over STARTTLS or it does not go out.
Backups
Daily snapshots of your workspace, retained and recoverable. Uptime is monitored around the clock.
AI access is read-only
An assistant you connect can read leads, pipeline, tasks and calendar. It cannot send, change or spend anything — that limit lives on our server, not in a setting. Every request is logged and a key can be revoked in one click.
Account activity log
Sign-ins, factor changes and other account actions are recorded, so you can see what happened and when.
Yours to take
Leads, contacts and other lists export to CSV from the app at any time. On the way out, ask and we'll arrange a full copy.
Payments
Cards are handled by Stripe and PayPal. Kernalite never sees or stores full card numbers.
What happens to data when a trial or subscription ends
Nothing is deleted when a trial lapses or a subscription is cancelled. The workspace locks, the data stays, and subscribing again brings everything back exactly as it was. A workspace is only erased when you close it yourself from Settings, and that action asks for confirmation.
Compliance for calling and texting
Outbound messaging supports A2P 10DLC brand registration, automatic opt-out handling, do-not-call suppression, and AI calling with the required disclosures and recording controls. Your obligations under TCPA are still yours; the tooling is built so that meeting them is the default path, not extra work.
Who has access on our side
Operational access is limited to the people who run the service, for operations, support and abuse prevention. We do not sell your data and we do not use it for our own marketing. The privacy policy is the binding version of this page.
Report a vulnerability
Found something? Tell us through the contact form with enough detail to reproduce it. Reports go straight to the engineers, and we'll reply to every one.