Skip to main content

Compliance · GDPR

GDPR: what Kayzen does with your data, and what it brings to its security

The GDPR concerns Kayzen in two ways: as a processor that handles data on behalf of its business customers, and as a tool that can contribute to the security measures that article 32 requires of every controller.

General information, not legal advice. Your situation and obligations are to be validated by a professional. Kayzen contributes to certain measures; it does not make any organisation compliant.

Kayzen Security is under development: no module is on sale yet. The contributions described here are based on K-Comply's technical mapping and on the actual status of each module as of 31 October 2026.

Kayzen, processor of your data

  • A published data processing agreement

    The DPA (GDPR article 28) describes the processing, the security measures and each party's obligations.

  • A list of subprocessors

    Every provider involved in the processing is listed publicly, with its location.

  • Minimisation by default

    The agent collects technical information about devices; it never collects your keystrokes, and the content of a file is only sent for analysis with your explicit consent. Email analysis is only turned on at the customer's decision.

  • Retention periods enforced by code

    Data is designed to be purged automatically when the retention periods published in the privacy policy expire.

  • Hosting intended for the European Union

    Business customer data is intended for a hosting provider located in the European Union; the final choice is in progress and will be published. A few subprocessors established outside the EU (sending transactional emails, payment and, if turned on, Kayzen Copilot) may receive limited data, with the safeguards provided for by the GDPR: they are all listed on the Subprocessors page.

Data processing agreement (DPA)Sub-processorsPrivacy

Contribution to the security measures of article 32

Article 32 requires technical and organisational measures appropriate to the risk. Here are the ones Kayzen can contribute to.

  • Encryption

    Monitoring of disk encryption on Windows computers (BitLocker) and escrow of recovery keys (under development).

  • Confidentiality and integrity of systems

    Patches, malicious site filtering, malware protection, application control (depending on the status of each module).

  • Availability and resilience

    Incident detection and response, isolation of a compromised computer (modules under development). Backups remain your responsibility.

  • Access control

    Two-factor authentication and console roles, monitoring of local administrator accounts; controlled privilege elevation and rotation of administrator passwords (modules planned or under development).

  • Regular assessment

    Monthly hygiene and compliance reports, indicators measured on the fleet.

In the event of a data breach

The controller must notify the CNIL without undue delay and, where feasible, no later than 72 hours after becoming aware of a breach, unless it is unlikely to result in a risk to individuals; beyond that deadline, the delay must be justified (article 33). The controller informs the people concerned in the event of a high risk (article 34). Kayzen's audit log and incident information can help document the facts; the decision and the notification remain yours.

Limits

  • Kayzen does not keep your record of processing activities and does not carry out your impact assessments.
  • Handling data subject rights (access, erasure…) for your own processing remains your responsibility.
  • Filtering and employee activity logs must be disclosed and proportionate, in accordance with employment law.

Sources · Règlement (UE) 2016/679 — EUR-Lex (new tab)

See also