Security
Effective date: 11 November 2026
For your IT and procurement: where KLO Document Control runs, what it can reach, who can change it, and who else is involved. The privacy statement and terms of use say the same in more detail.
Where your data is
- Your register, documents, emails and audit log are in your company's own Microsoft 365 (SharePoint and Exchange) and on your people's devices. KLO never receives or stores them, except as the next point but one says. The app and the web register read and write them with each person's own Microsoft sign-in.
- KLO's account server keeps only each person's KLO account: their email address, a sign-in token and whether they're subscribed. It runs on Cloudflare, with its database in Western Europe. Payments on the web are taken by Stripe; KLO never sees card details.
- KLO's link server serves the folders your people share with "Anyone with the link", from dc.klodevelopmentservices.co.uk. It reads only those folders, read-only, through KLO's own Microsoft app "KLO Document Control links", which your IT approves once (Files.Read.All, an app permission; KLO's code limits it to the shared folders). Downloads go straight from your SharePoint, so it stores no files. It keeps a record of each link (folder name, who made it and when, expiry, a hash of any password) and when it was opened and which files were downloaded. These are deleted 90 days after the link expires. It runs on Cloudflare, with its database in Western Europe.
What it can reach in your Microsoft 365
The permissions are listed in the privacy statement, each with why. Your IT can approve the app once for everyone, with the core permissions only (files, sites and mail) or with all of them; the IT guide has both links. Each person still acts only as their own Microsoft 365 account allows: the app can't reach anything they can't.
KLO links are a separate Microsoft app, "KLO Document Control links", with one permission: Files.Read.All, read-only. Your IT approves it only if your people are to share folders with anyone who has the link; without it, folders can still be shared with named people. Even once it's approved, KLO links stay off for your company until a Global or SharePoint admin turns them on in the web register's Shared folders tab. There they see every live link and can take any of them away; turning links off takes them all away at once. Only people with their own subscription can make one.
The web pages
- The web register, the consultants' page and their help are at dc.klodevelopmentservices.co.uk, on their own address apart from KLO's other web pages, served only over HTTPS (HSTS).
- Each page's Content-Security-Policy names its scripts by their hashes, so no other script runs in it, and lets it reach only Microsoft's sign-in, Microsoft Graph, your SharePoint, KLO's account server and KLO's link server. No analytics or tracking.
- A person's Microsoft sign-in is kept for that browser tab only.
- Your company's consultants' page can be your own copy, on your own web server; the IT guide has the steps.
Who can change what KLO serves
- Only KLO can publish the pages or its servers, from KLO's own Mac, signed in to KLO's Cloudflare account with two-factor sign-in.
- Before each publish, every engine file is checked against its recorded SHA-256, and the publish stops if any differs. After it, every live file is read back and compared byte for byte with what was built, and the security headers are checked.
The KLO account
- A person signs in with a 6-digit code emailed to their own Microsoft 365 work address. A subscription unlocks only the address it's under, so it can't be shared round a team.
- Without one, projects are read-only for that person: nothing is deleted, and everything can still be read, opened and exported. People from outside your company don't need one.
- If the account server can't be reached, the app and the web register carry on with its last answer for 7 days.
Who else is involved
| Who | What for | Whose |
|---|---|---|
| Microsoft | Your Microsoft 365: sign-in, SharePoint, Exchange; KLO's sign-in code emails | Your company's own provider; KLO's for the codes |
| Cloudflare | Hosts KLO's web pages, the KLO account server and the link server | KLO's provider |
| Stripe | Takes payments on the web | KLO's provider |
| Apple | The App Store; iCloud Keychain keeps the Anthropic key, if you enter one | Each person's own account |
| Anthropic | The AI, only if you turn it on, with your own Anthropic key | Your company's own provider |
KLO uses no one else for KLO Document Control.
If something goes wrong
Tell KLO at [email protected]. If KLO finds a security incident that affects your company's data, KLO will tell you within 72 hours of finding it, with what happened and what to do.
What this isn't
KLO Document Control hasn't been independently tested or certified (for example to ISO 27001 or Cyber Essentials). KLO is a small company; this note says what is actually in place.