Security & scale
Workspace isolation, role-based access, human-approved agents and built-in export and erasure: Kleos security as it is actually built.
Kleos is built to be handed to a security review without a meeting. Access is scoped by workspace and role, the AI agent cannot act without a human approval, and your data stays yours: exportable and erasable on demand. The same platform that runs a single gifting drop is engineered to handle thousands of creators and millions in attributed revenue without changing how it behaves.
Security pillars
Workspace isolation
Every record is scoped to its workspace on the server, never by what the client sends. One brand can never read another's roster, campaigns, or numbers.
Role-based access
Owner-only surfaces for billing and destructive actions, scoped roles for teams, and agency access that is granted per workspace and revocable in one click.
Human-approved agents
Ask Kleos and MCP agents propose; a human approves; the system executes. Nothing reaches a creator, a contract, or a payout on model output alone.
Encryption
Data encrypted in transit and at rest. Secrets and API keys are stored server-side and never shipped to the browser.
Data ownership & export
Your creators, campaigns, and attribution are yours. Export your data from Settings, or erase it for good. No lock-in on the data that drives your decisions.
Subprocessors, in the open
Our data processing agreement and full subprocessor list are published on the legal pages, so your review starts from the actual facts.
Reliability and scale
of agent sends behind human approval
record per creator, every motion
export and erasure, built in
Reliability is engineering, not a marketing number: health-checked deploys, graceful shutdowns, and monitored errors. Attribution, gifting, and reporting are built to hold their performance as your roster and order volume grow, so scaling up a program never means rebuilding it.
Governance you can hand to security review
Workspace isolation, scoped roles, human-approved agent actions, and built-in export and erasure give your security team the controls they expect to see. The DPA and subprocessor list cover the contractual side, so adopting Kleos is a question of configuration rather than exception.
The roster is free forever, and campaign plans carry a 14-day trial. See Getting started to connect your store, or the Integrations page for how the pieces link up.