This page describes how we protect the Kagura AI Cloud Edition and the data you entrust to it, as it is today. It lists only measures that are already in place, and we update it when they change. Our legal commitments are in the Privacy Policy and the Terms of Service; if this page and the Privacy Policy ever differ, the Privacy Policy applies.

1. Where your data lives

Memories and account data are stored in our databases (PostgreSQL, and Qdrant for search) on SAKURA internet's cloud in Japan (Ishikari, Hokkaido).
Uploaded files and encrypted backups are stored in Cloudflare R2 with an Asia-Pacific location hint. Cloudflare does not guarantee a specific country for this hint.
Your requests pass through Cloudflare's network, which handles them at a location near you.

2. Encryption

In transit — traffic between your device and Cloudflare, and between Cloudflare and our servers, is encrypted with TLS; our servers present a certificate that Cloudflare verifies. HSTS is enabled.
At rest — our server disks are encrypted (AES256-XTS) with a key held in SAKURA internet's Key Management Service. Cloudflare R2 encrypts the objects it stores.
Backups are encrypted before they leave our servers. The keys that can decrypt them are not stored on any server.
Especially sensitive credentials, such as two-factor authentication keys, are encrypted once more by the application before they are stored. API keys are stored only as hashes.

3. Network

Our servers accept web traffic only from Cloudflare. The database server has no public IP address.
Cloudflare's web application firewall (managed rules) and rate limiting sit in front of the Service.
Administrative access to the servers uses SSH keys only, over a restricted network path.

4. Backups

We take an encrypted backup of the databases every day and keep 14 daily and 4 weekly backups (about 35 days at most, as stated in the Privacy Policy).
While a backup is kept, it cannot be deleted or overwritten — not even with the credentials of the server that writes it.
Whether the latest backup is fresh is shown publicly as "Data Backups" on our status page.

5. Access to your data by our staff

Administrative access to production systems is limited to the operator named in the Privacy Policy.

6. Availability

The availability of the Service and its components is checked every minute and published on our status page.

7. Reporting a vulnerability

Please report security issues to security@kagura-ai.com (also listed in our security.txt). We answer in English or Japanese.

8. If something goes wrong

We follow a written incident-response procedure: assess, preserve evidence, contain, rotate credentials, and notify. If a personal-data breach occurs, we notify the supervisory authority and, where the breach is likely to result in a high risk to you, notify you directly, as described in "Data Storage & Security" in the Privacy Policy.

9. Your data and AI

We do not use your memories to train AI models, we do not sell your personal data, and we do not use your memories for advertising.
How long we keep each kind of data, and how deletion works, is set out in "Data Retention" in the Privacy Policy. After you delete your account, data left in backups is erased once the backup retention period (about 35 days at most) has passed.

10. Service providers

The services we use to run the Service, what data each receives, and for what purpose are listed in the Privacy Policy ("Third-Party Services").

11. Certifications and documents

We do not currently hold third-party certifications such as SOC 2 or ISO/IEC 27001.
For a security questionnaire, contact security@kagura-ai.com.
Custom-plan customers who act as controllers for their workspace data can request a signed Data Processing Agreement via privacy@kagura-ai.com.

Trust & Security