Data and privacy
Kroll Assistant holds connection details and the working view of the business. It does not copy the business into itself.
What is stored
| Stored | Why |
|---|---|
| Workspace and your user record | So the workspace opens for you and no one else |
| Connection status, account label, granted permissions | To show the correct state on each card |
| Encrypted access and refresh credentials | To call the service when it syncs |
| Sync runs and their results | To show when a sync worked and what failed |
| Assistant conversations and messages | To reopen the thread and carry it to a chat channel |
| Channel accounts, linked chats and inbound event records | To deliver replies and drop duplicate calls |
| Approvals | One record for each outbound action the assistant performs |
| Audit events | Connect, disconnect, sync, permission change, sign-in, chat activity |
What is not stored
- No passwords. Services are connected through their own sign-in screens; the app never sees a password.
- No credentials in readable form. Access and refresh credentials are encrypted before they are written. The app can use them; nobody can read them back out of the database or the API.
- No client documents or email bodies. Sync reads metadata — names, dates, statuses — not the content behind it.
- No legal case material. The workspace does not read case documents, transcripts or the case database, and the assistant is told not to discuss them.
Where the data lives
The workspace runs on a private server. Kroll Assistant’s own database and its encryption key live beside the application and are excluded from version control and from backup copies that are shared.
Moving the database without its key makes every stored credential unreadable — the services would all have to be reconnected. Keep the two together.
Sign-in and sessions
- Signing in sets a session for seven days in that browser.
- The session value is signed, so it cannot be edited to claim another user.
- Every action that changes something carries a separate request token, which stops another site from acting on your signed-in session.
The assistant
- Answers are stored with the conversation so the panel can reopen the thread and a chat channel can keep the same context.
- The assistant reads dashboard rows and connection metadata. It never receives provider tokens and never reads another workspace.
- Start over begins a new conversation and clears the panel; the new thread is separate from the one before it.
- Outbound messaging is off unless the workspace enables it. When it is on, the assistant asks you to confirm the text, writes an approval record, then sends and audits the message.
Chat channels
- The Telegram bot token and webhook secret are encrypted in the workspace database and never returned to the browser.
- WhatsApp is linked as a device. Its session keys and the bridge token stay in the workspace data folder, outside version control, and the bridge listens on loopback only.
- A chat is linked with a single-use pairing code. An unlinked sender receives one instruction and no answer.
- Inbound message identifiers are stored so a repeated delivery cannot produce a second answer.
- Long answers are split to the provider’s size limit; only direct messages are handled.
Disconnecting
Disconnecting a service deletes its stored credentials, account label and permissions. The audit log keeps a record that the disconnect happened — never the credential itself.
Disconnecting a chat channel deletes its stored credentials and label. Linked chats stay on the list until you remove them with Unlink.
Access
The workspace has its own address, https://assistant.agentkroll.com .
A team access check runs before the workspace sign-in, and no part of the app is
served to clients.
- Do not share the address or the access check with anyone outside the team.
- Do not screen-share the Connect page while a token is being entered.
- If a device is lost, sign out from the workspace and disconnect the affected services once you have a new session.
Reporting a concern
If something looks wrong — an unfamiliar audit event, a connection you did not make, a token that keeps failing — stop using the service card, disconnect it, and report the time and the event to the workspace administrator. The audit log is the record that makes this fast.