# Security & compliance > How Kepler protects your data — encryption, access control, GDPR and PDPA. _Collection: Workspace, Team & Billing (workspace-admin) — Kepler Help Center. Canonical: https://keplercrm.com/support/articles/security-and-compliance/_ ## Access control - **Workspace isolation** — every record belongs to one workspace; only its members can access it. All API access is authenticated and workspace-scoped. - **Roles** limit what members can do (see [Roles & permissions](/support/articles/roles-permissions/)). Placement fee figures and the Placement Finance dashboard are restricted to owners, admins and the Finance role. - **Email privacy** is enforced per connected account, with three sharing levels and per-person grants (see [Email privacy & sharing](/support/articles/email-privacy-and-sharing/)). - **Files** (CVs, recordings, attachments) are served only via short-lived signed URLs to authenticated members. - **Emergency access** — when someone is away and their inbox needs covering, an owner can let one member read a personal account for a set time, with a reason, under **Emergency access** in **Settings → Security & data**. Grants can be revoked at any time. ## Two-factor authentication Under **Settings → Security**, every member can set up an authenticator app (TOTP — Google Authenticator, 1Password, Authy or similar) with **Set up**, add a second device with **Add device**, or remove it. Workspace admins set the rule for everyone in the **Sign-in** section of **Settings → Security & data**: - **Require two-factor** — members without a verified authenticator app must set one up before they can use the workspace. Signing in through your identity provider (single sign-on) also counts. - The same row counts how many members are enrolled; **Show** lists who is and who isn't. When the workspace requires it, each member's own Security page says so. ## Single sign-on Kepler supports SAML 2.0 sign-in for an email domain, but it is **not self-serve**: Kepler configures the connection during onboarding. Send your identity provider's metadata URL and the email domain you want connected. You can enter both under **Identity provider** in **Settings → Security & data** and click **Email support** to send them. Once a connection is live, people with that email domain see **Continue with single sign-on** on the login page, the connection shows the role new members join with, and an admin can turn on **Require single sign-on** in the same section. Changes to a live connection also go through support. > **NOTE:** Contact us about security controls at support@keplercrm.com . ## Data protection Your workspace's data and sign-in are hosted in Germany (EU), and files such as CVs and recordings are stored in the EU. Kepler is a Singapore company and some features use service providers in other countries; the privacy policy lists them and where they are. Third-party credentials Kepler stores on your behalf — mailbox access tokens and webhook signing secrets — are encrypted at rest with AES-256-GCM under keys held outside the database. For everything else, Kepler's published privacy policy is the authoritative statement: it says data is encrypted in transit and at rest, that Customer Data is not used to train AI models, and that Kepler complies with the PDPA and applicable UK/EU GDPR. Refer to the current policy for its exact wording. - Payment details are held by our payment processor, not Kepler. - See [AI & data privacy](/support/articles/ai-data-privacy/) for how AI features handle workspace content. - Users with permission to delete activities can permanently remove a meeting's recording, transcript and minutes using **Delete meeting data**. ## What deletion does - A deleted **candidate, contact, company, job or placement** leaves active views, search and matching. The delete toast offers a 10-second **Undo**. - After that, an admin can bring it back from **Recently deleted** (**Settings → Security & data** → **Deleted records** → **Recently deleted** → **Open**) with **Restore**. - Deleted records are kept for the period set in **Keep deleted records for** (30 to 365 days), then removed for good. - An owner can remove a record sooner with **Delete permanently** on the Recently deleted page, confirmed by typing its name — use this for erasure requests. - **Members can delete records** — when off, only owners and admins can delete. Everyone can still edit. ## Getting data out Any record list exports to **CSV or Excel** from its **Export** menu, filtered and column-shaped as you have it on screen. For a workspace-wide export, an owner can click **Request export** under **Data & closure** in **Settings → General**; Kepler emails you when it's ready. For an export in a specific format, contact support. ## Data subject requests - **Lawful basis & consent** — use the native consent record to track purpose, lawful basis, source, dates and evidence for each candidate or contact. See [Consent and GDPR records](/support/articles/consent-and-gdpr-records/) for setup and recording steps. - **Subject access & erasure** — a candidate's record consolidates their data (profile, documents, communications) for access requests. For erasure, delete the record and have an owner use **Delete permanently** in Recently deleted; contact support for bulk compliance operations. - **The public portal** collects only what applicants submit, protected against abuse (rate limiting, honeypot), and exposes advertised fields rather than internal CRM fields. Review advertised text for confidential information before publishing. ## Your part of the bargain - Remove leavers from the workspace promptly. - Use conservative email sharing for mailboxes containing non-work content. - Tell meeting participants when the [Note Taker](/support/articles/ai-note-taker/) is covering a call, per local law — especially Zoom calls, where capture is native and no bot appears.