Security and privacy

How Klantly protects your keys and data, and what you can do yourself.

What Klantly does#

• Keys are only stored as an encrypted fingerprint and are never logged.
• A key only sees the data of its own company. Records of another company do not exist for a key.
• A key never gets more permissions than the administrator who creates, edits or renews it. The key belongs to the company, not to that person: if its creator leaves, it keeps working until you revoke it.
• All traffic goes over HTTPS. The API uses no cookies and does not accept requests from a browser.
• Rate limits protect against abuse and against integrations that run out of control.
• Every change made through the API appears in Klantly's activity log, with the name of the key.

Request log#

For each request Klantly only stores the method, the endpoint, the status, the error code, the duration, the IP address, the user agent and a request id, for 30 days. Refused requests with an existing key are included too, for example from a revoked key or from an unknown IP address. Of a burst of 429 responses, only the first of each minute is logged. The content of requests and responses is not stored, and neither is the query string. You find this log in Klantly under Integrations → API → Usage.

What you do yourself#

• Store keys safely on your server, never in source code or in an app.
• Use an IP allowlist if your integration runs from fixed addresses.
• Choose an expiry date and renew keys regularly.
• Revoke a key immediately if you think it has leaked.

Privacy#

Through the API you process personal data of your customers. You remain responsible for it; Klantly processes it on your behalf. Only fetch what you need and do not keep it longer than necessary.

Reporting a vulnerability#

Found a security problem? Report it through support. We respond as quickly as possible and ask you not to disclose the problem until it has been fixed.

Last updated on September 15, 2026