Is Kojo OS SOC 2 certified?

Kojo OS runs on cloud infrastructure that is audited to SOC 2 Type II. Kojo Growth does not hold a SOC 2 report of its own, and we say so plainly rather than borrow a badge.

Which vendors handle my data?

The trust center lists every vendor that touches the data from our website and forms, what each one does for us and what it sees. It also lists the controls in place today and the documents you can ask for.

Who owns my data and accounts?

Your domain, content, Google Business Profile, analytics and accounts are always yours and stay in your name. If we part ways, any site we built is handed over or bought out on terms set in writing.

Security and compliance

Your data, your leads and your name, protected

Kojo OS calls and texts people on your behalf, so it has to be careful with their data and with your reputation. Here is exactly what is in place today, and what is not offered yet.

Standards

SOC 2 Type II hosting
Kojo OS runs on cloud infrastructure audited to SOC 2 Type II.
Encrypted
TLS 1.2 or higher in transit, encryption at rest in production.
STIR/SHAKEN calls
Calls are signed and placed over a STIR/SHAKEN carrier network.
TCPA consent
Consent wording on every form, STOP and do-not-call always respected, calls only in allowed hours.
Registered texting
Business numbers registered for texting, with spam monitoring.

How it works in practice

Encrypted, in transit and at rest

Data moves over TLS 1.2 or higher and is encrypted at rest in production databases and storage. Each person on your team sees only what their role allows.

Hosted on SOC 2 Type II infrastructure

Kojo OS runs on cloud infrastructure audited to SOC 2 Type II, with automated backups.

Data protection terms

The platform's data processing terms set out how your data is handled, with a named list of the providers it uses.

Consent and STOP

Only leads who asked to hear from you. Anyone can reply STOP, and do-not-call always wins.

Honest AI, at the right hours

It says it's an AI if asked, and calls only inside each lead's allowed local calling hours.

Local numbers in your name

Calls and texts come from local numbers for your business, registered for texting, with spam monitoring on every number.

You approve first

You hear the voice and approve every script before anything goes live. Every call is recorded and summarized.

You own your accounts

Your domain, content, Google Business Profile, analytics and accounts are always yours and stay in your name.

Terms in writing first

Everything is agreed in writing before work starts. If we part ways, any site we built is handed over or bought out on terms set in writing.

Access, logging and recovery

Each person on your team signs in with their own login, and roles decide what they can see and change.
Sessions time out after a period of no activity.
Sign-ins and admin actions are logged.
The platform's data processing terms commit to backups and to telling you if something goes wrong.

Questions about security

Is Kojo OS SOC 2 certified?: Kojo OS runs on cloud infrastructure that is audited to SOC 2 Type II. Kojo Growth does not hold a SOC 2 report of its own, and we say so plainly rather than borrow a badge.
Which vendors handle my data?: The trust center lists every vendor that touches the data from our website and forms, what each one does for us and what it sees. It also lists the controls in place today and the documents you can ask for.
Who owns my data and accounts?: Your domain, content, Google Business Profile, analytics and accounts are always yours and stay in your name. If we part ways, any site we built is handed over or bought out on terms set in writing.

Want the data processing terms or have a security question? Email hello@kojogrowth.com or see the privacy policy.

Hear it for yourself, on your own phone.

Get my free demo