How Karma Compass protects your board’s records

We do not use your organization’s records to train AI models, and neither do the AI providers we use.

The models that draft agendas and minutes and answer questions are reached through OpenRouter. Every request is restricted to endpoints with zero data retention: they keep no copy of what we send, and they do not collect it or use it to train models. Today those endpoints run on the servers of:

• Microsoft Azure
• Google Cloud Vertex AI
• Together AI
• Fireworks AI

To make your documents searchable, their text is processed by Amazon Bedrock inside our own Amazon Web Services account. Amazon does not store it or use it to train models.

If you connect your own assistant, such as Claude or ChatGPT, the company behind it handles what it reads under its own terms.

• Your connection to Karma Compass is encrypted (HTTPS).
• Uploaded files are stored in private Amazon Web Services storage in the United States, encrypted with our own key, and checked for tampering every time they are read.
• Every file is checked before it is stored: it must be the kind of file it claims to be, and Word documents containing macros are refused.
• Text is read out of your files on our own servers. When a feature needs it, only that text is sent to the AI services above, never the file.

• Members sign in with a one-time code sent to their email address. There are no passwords to steal.
• Everyone on your board can read its records. What each person can change, such as publishing an agenda, adopting minutes or deleting a document, follows the role your board gives them.
• Each organization’s documents, minutes and meeting records are kept apart by the database itself (row-level security), not only by our application.
• An assistant you connect acts as you and can do no more than your role allows. You can disconnect it at any time.

Nothing becomes official until someone on your board with the authority to approve it does. The agents prepare the work; your board makes the decisions. See who approves what.

Anyone on your board can download its documents at any time. An administrator, executive director or board staff liaison can delete a document from the board’s library, with all its versions and searchable text.

If a subscription ends, your board can still read and download its records. For a full copy of your organization’s records, or to close its account and have them deleted, email support@karmahq.org. When your organization closes its account, we delete or anonymize its information unless we are required to keep it.

Your organization keeps ownership of everything it uploads. Our Terms of Service and Privacy Policy, which forms part of them, set out how we handle your information, including that we do not train AI models on it.

For a data processing agreement or a security questionnaire, or to report a security problem, write to support@karmahq.org.