Security & Trust

In short

• One Kist can never see or change another Kist’s guides, people or recordings.
• Nobody can read our database straight from a web browser, signed in or not.
• Every part of the app that takes information checks its size and shape before using it.
• A share link works only while sharing is on, and stops on the end date you set.
• When you turn sharing off, the link stops opening straight away, and any video or picture links it already gave out stop working within 5 minutes. We can’t take back anything a viewer’s browser has already loaded.
• Someone removed from a Kist loses access straight away, including any recording they had already started.
• Lowering someone’s role takes effect on their next click, including any recording they had already started.
• Other websites cannot sign you in or act as you.
• When Windows identifies a password box, the recorder replaces what you type there before anything is saved.
• Full web links and web code the AI copies off your screen are taken out of your guide unless you typed them.
• When you delete something, its files are deleted too. If that fails, we try again every day.
• Each time our staff open the list of all Kists, it is written down.
• Every change to our code is checked for leaked passwords and keys.
• Our website only talks over a secure connection, and our public pages were scanned for weaknesses.

Encryption

Data is encrypted in transit using TLS (HTTPS) on every connection to Kistorium and between Kistorium and the services we rely on. Stored data is encrypted at rest by our infrastructure providers: video, audio, and screenshot assets in Cloudflare R2, and structured data (accounts, Kists, guides and audit logs) in Google Firestore.

Hosting and data location

The Kistorium application runs on Google Cloud Run in the United States (the us-central1 region). Structured data is held in Google Firestore and media assets in Cloudflare R2. We process and store data in the United States and in the other regions operated by these providers. International transfers and the safeguards that protect them are described in our Privacy Policy.

Access control

Each customer's data lives in its own Kist, and the application enforces tenant isolation on every request, so one Kist cannot read or write another's data. Within a Kist, access is governed by member roles set by the Kist's Admins. Sign-in is handled by Firebase Authentication using Google or Microsoft sign-in; we never see or store your password.

Kistorium staff can see a list of every Kist, with its name, its Admins' email addresses and its balance, so we can run the service and help with billing. Each time staff open that list, it is logged. Staff can also reach a Kist's content through our cloud providers' consoles. We do this only to give support you ask for, to fix a fault, or to look into security or abuse.

Passwords while you record

1. When you click into a box, the recorder asks Windows: “Is this a password box?”
2. If Windows says yes, the recorder notes that you pressed keys, but not which keys.
3. Any keys you press in the split second before Windows answers are wiped too.
4. Your video only shows dots, the same as a password box always does.

Good to know: some boxes don't tell Windows they're for passwords, such as command windows and PIN pads. Typing there is recorded like any other typing, so avoid typing a password into one of those while recording.

AI data handling

To produce a tutorial we send capture data to AI sub-processors: Google Vertex AI (Gemini) extracts the steps and ElevenLabs generates the spoken narration. ElevenLabs receives only the narration text and returns the audio. It keeps a copy in our account’s history, and we delete that copy as soon as we have saved ours. The pictures in your guides come from your own recording or from pictures you add. They are not made by AI. We also send Google Vertex AI the text and documents you provide when you write a guide, under the same Google Cloud terms that prohibit training. The narration is synthetic. See the AI and automated processing section of the Privacy Policy for detail.

Sub-processors

We use a small set of trusted providers to operate Kistorium. Each acts on our instructions to deliver the service, except Stripe, which acts as an independent controller for payment processing under its own privacy policy. This list was last changed on 11 October 2026. Before we add or replace a provider that handles your data, we update this list and its date, and we email the Admins of business customers who have a Data Processing Agreement with us in advance.

Data retention and deletion

Recordings and the assets derived from them are retained until you delete them or delete your Kist. When you delete content, it is removed from the live service immediately. We keep a weekly backup of our database for 12 weeks so we can recover from a disaster, so a deleted record can remain in a backup for up to 12 weeks and is then gone for good. Recordings and other stored media have no separate backup copy. Deletion removes both the stored media and its database records. If removing a stored file fails, we keep a record of it and try again automatically every day until it is gone. Any file still there after seven days is flagged to our staff to deal with. You can read more in the Retention section of the Privacy Policy.

Vulnerability disclosure

If you believe you have found a security vulnerability, please report it to support@kistorium.com.

We support good-faith security research. If you report a genuine issue privately, give us reasonable time to fix it, and avoid accessing or modifying other people's data or degrading the service, we will not pursue or support legal action against you for that research. We are grateful to researchers who help keep Kistorium safe and will acknowledge contributions here with permission.

Breach response

If we find a security problem, we look into it straight away, contain it and fix it, and we tell affected customers when the law requires it. Where a privacy breach is likely to cause serious harm, we will notify affected individuals and the New Zealand Privacy Commissioner as required by the Privacy Act 2020, and will meet the equivalent obligations in other regions where they apply.

Certifications and posture

We are an early-stage product and state our posture honestly. We do not currently hold a formal external certification such as SOC 2 or ISO 27001. We build on infrastructure (Google Cloud, Cloudflare, Stripe) that maintains those certifications, and we will pursue formal certification as the product matures. If you have a specific security or compliance requirement, contact us at support@kistorium.com.