Data and privacy
What Kognit stores, how workspaces are isolated, and how to handle a deletion request.
On this page
What's stored
| Data | Why |
|---|---|
| Tickets and messages | The conversation itself |
| Contacts | Identifying and recognising customers |
| Attachments | Files customers send |
| Connected account credentials | Syncing mail and stores — encrypted at rest |
| Knowledge base articles | What the AI answers from |
| Usage records | Billing and quota |
Workspace isolation
Every record carries the workspace it belongs to, and every query is filtered by the authenticated identity of the caller. Access rules are enforced on the server for every request, not by hiding things in the interface.
There is no setting, plan, or support action that lets one workspace read another's data.
Credentials
OAuth refresh tokens and integration secrets are encrypted at rest. They are used only to sync your mail and stores and to send on your behalf.
Revoking access at the source — Google, Microsoft, Meta, Shopify — immediately stops Kognit's access, regardless of what Kognit holds.
AI processing
Customer messages are sent to an AI model to classify intent and generate replies. Your knowledge base content is included so the model can answer from your material.
The AI answers from your knowledge base and connected data only. It does not draw on general knowledge about your industry, and it does not invent policies you never wrote down. An empty knowledge base produces an AI that escalates, not one that guesses.
Handling a data subject request
Access. Export the contact's record and their ticket history from their contact page.
Erasure. Delete the contact and their tickets. Deletion is permanent — export first if you need a record for your own compliance.
Rectification. Edit the contact record directly; changes apply everywhere that contact appears.
Objection to marketing. Unsubscribe them. Suppression is workspace-wide and immediate. See Unsubscribes and compliance.
Your responsibilities
Kognit is a processor for the customer data you put in it. You are the controller. That means:
- Have a lawful basis for the data you collect
- Tell customers you use a third-party support platform, in your privacy policy
- Respond to data subject requests within your statutory deadline
- Don't collect sensitive categories of data in chat unless you have a basis for it
Deleting your workspace
Cancelling a subscription does not delete data — it reverts you to Free limits. To have data deleted, request it explicitly. Export what you need first; deletion cannot be undone.
Related