Security at Keito
Security at Keito
Last reviewed: 16 October 2026
Keito is operated by OSO DevOps Limited, company number 10889879, registered in England and Wales. This page explains our access controls, data handling, and how to contact us about a security concern. Our Privacy Policy and Terms of Service describe the applicable data-protection and service terms.
Report a security concern
Email support@keito.ai with the subject Security report. Include the affected product or URL, a description of the issue, the time you observed it, and steps that help us understand it. Please avoid including customer records in the initial report.
Do not send passwords, API keys, session cookies, authentication codes, or access tokens. Contact us before carrying out security testing; the restrictions in our Terms of Service continue to apply.
For an account you believe has been accessed without permission, tell us which account is affected and when you noticed it. Current service availability is shown on our status page.
Authentication and workspace access
Keito uses WorkOS for authentication. Workspace roles and permissions determine which records and actions an authenticated user can access. Keito checks workspace membership and permissions on the server.
Keito supports authenticator-based two-factor authentication. Workspace owners can require it for their members. Microsoft Entra SSO is also available for eligible workspaces; those workspaces manage multi-factor authentication with their identity provider.
When connecting an integration, use your own account and the access your workspace has assigned to you. Review the permissions requested by the provider before approving a connection.
Data handling
Keito’s website and web application use HTTPS. Our Privacy Policy, Sections 5 and 8 describes our service providers, security measures, and the circumstances in which people may access Customer Data. We do not routinely review Customer Data; access is limited to the purposes described in that policy.
We do not use Customer Data to create, train, fine-tune, evaluate, or improve generalised or shared AI or machine-learning models. When you choose to connect an external AI or agent service, its own terms and settings govern that provider’s handling of the information you authorise it to receive. Google Calendar data and data derived from those events are excluded from Keito’s AI-agent and MCP integrations.
Integrations, retention, and deletion
Connecting a third-party service authorises the exchanges needed for the features you enable. Disconnecting normally stops future exchanges; it does not automatically delete records already copied to Keito or the other service.
Our Privacy Policy, Section 7 sets out retention periods, including active account data, technical logs, and billing records. You can request account or workspace deletion and contact us about data-protection requests at support@keito.ai. A third-party provider may retain its own records under its own agreement with you.
Agreements and questions
Our Terms of Service provide for a Data Processing Agreement, available on request, when you use Keito to process personal data of third parties. Email support@keito.ai with the subject Data Processing Agreement to request it or to ask about a procurement or security questionnaire.
For personal-data incident notification and your data-protection rights, see Sections 8 and 9 of the Privacy Policy.