Security

How access is protected.

KT Console reads work data from your company's tools, so who can start a capture, what it can reach and where the results go matter most. This page describes how that works today. Last updated 3 November 2026.

Who can do what

  • Only a Google Workspace super admin can create a company account, and this is checked with Google. That person becomes the Owner.
  • Owners invite Admins from the same company. Owner status is re-checked with Google every hour, so a removed super admin loses it.
  • Every sign-in, capture, share, task change, setting change and file transfer is written to an audit log that cannot be edited from the app.
  • Handover documents are shared only with people inside your company.

What KT Console can reach

Your super admin approves our service account in the Google Admin console (domain-wide delegation) for these scopes:

  • gmail.readonly: read mail for a capture. It cannot send, change or delete mail.
  • drive: list a person's documents, create the handover document, share it, and move file ownership when an Admin asks for it.
  • admin.directory.user.readonly and admin.directory.domain.readonly: find people and your company's domains, and confirm super admins.
  • admin.datatransfer: transfer all of a person's Drive files to a new owner, only when an Admin confirms it.

Signing in with Google asks only for your name and email address (and, the first time, read access to your directory entry to confirm you are a super admin). Slack is connected with the connecting Owner's own account (scopes search:read, users:read, users:read.email, channels:read, groups:read, channels:history, groups:history), so it sees only what that person can see; a separate bot (chat:write, users:read, users:read.email) only sends task notifications. Basecamp is connected the same way, with the connecting Owner's account.

How data is handled

  • All traffic uses HTTPS, with strict transport security and a content security policy that only allows our own scripts.
  • Sign-in uses Google or a one-time email code. Sessions are random tokens in secure, http-only cookies; only a hash is stored.
  • Connection keys for Slack and Basecamp are encrypted with AES-256-GCM using a key held only by the server.
  • Sign-in attempts are rate-limited, and wrong codes lock an address after repeated tries.
  • The AI is told to treat captured text as data and never follow instructions in it, and never to copy passwords, keys or one-time codes into a handover.
  • Captured data is deleted after your company's retention period (90 days by default).

Infrastructure

The application runs on Vercel (US East) and stores data in PostgreSQL hosted by Neon on Amazon Web Services (us-east-2). Handovers are written through Anthropic's API. Secrets live in the hosting provider's environment settings, not in source code.

Report a problem

If you find a security issue, email hello@ktcapture.com with the details. Please give us a chance to fix it before telling others.