ref. framer

1. Purpose

Konekt is committed to protecting the confidentiality, integrity, and availability of information processed through its customer-service platform.

This Policy describes Konekt's security principles and confirmed security measures. It does not guarantee that any system is completely secure.

2. Scope

This Policy applies to Konekt's platform, relevant systems, and personnel who have authorized access to Konekt information or infrastructure.

Business customers remain responsible for their own devices, account credentials, agent permissions, and the lawful handling of information they submit to Konekt.

3. Access Control

Konekt uses role-based access controls for staff access. Access should be limited to what is necessary for assigned responsibilities.

Access rights should be reviewed when responsibilities change and removed when no longer required. Shared credentials and unauthorized access are prohibited.

4. Encryption

Konekt uses HTTPS/TLS encryption in transit and encryption at rest for stored data.

These controls reduce certain risks but do not eliminate every security threat. Encryption implementation and key-management arrangements should be reviewed as part of ongoing security work.

5. Audit Logging

Konekt maintains audit logs for staff access. Logs support accountability, investigation, and security monitoring.

Access to logs should be restricted to authorized personnel and logs should be retained for a defined period appropriate to their purpose.

6. Infrastructure and Service Providers

Konekt may rely on third-party infrastructure, hosting, AI, payment, communication, and other providers.

Provider security, access, data-handling terms, subprocessors, and processing locations should be assessed before use and periodically reviewed. Relevant contractual security and data-protection requirements should be documented.

7. AI Security

Konekt uses AI APIs, including the ChatGPT API and Gemini API, for customer-service functionality.

Information sent to these services should be limited to what is necessary for the feature. API credentials must be protected and must not be exposed in client-side code or public repositories.

Konekt should assess risks such as prompt injection, unauthorized disclosure, unsafe outputs, excessive permissions, and misuse of AI-generated content. AI outputs should be subject to suitable validation and access controls.

8. Data Minimization and Retention

Konekt aims to collect and process only information relevant to its services and defined purposes.

Retention and deletion schedules should cover conversations, tickets, attachments, AI outputs, account data, logs, billing information, analytics, and backups.

9. Security Incidents

Konekt will maintain an incident-response procedure to identify, report, investigate, contain, and document suspected security incidents.

The procedure should assign responsibility for incident decisions and address communications with affected customers, regulators, and individuals where required by law.

Business customers must promptly report suspected incidents involving their Konekt accounts or data.

10. Staff Responsibilities

Personnel with access to Konekt systems or data must follow applicable security procedures, protect credentials, use authorized access only, and report suspected vulnerabilities or incidents.

Security awareness and access reviews should be conducted as appropriate to Konekt's size and risk profile.

11. Security Improvements

Konekt will review and improve its security practices as the service evolves. Reviews should consider access controls, logging, infrastructure, provider changes, vulnerabilities, incident lessons, and data-protection risks.

12. Contact

To report a suspected security issue, contact privacy@konekt.is. Do not include passwords, API keys, or unnecessary personal data in a report.