Security

Your customers trust you. You can trust us with them.

How Kelmo protects merchant and customer data, from card payments to staff access.

How Kelmo protects data.

Card data handled by Stripe

Card payments are processed by Stripe, which handles card data on its PCI DSS–compliant infrastructure. Card numbers are not stored on Kelmo servers.

Encryption in transit

Every connection to Kelmo, from the website to the portal, is encrypted with TLS (HTTPS).

Role-based access

Owner, Manager, Staff and Accountant roles limit what each person can see and do.

Account security

Two-factor authentication, active-session review and sign-out-everywhere in the client portal.

Your data, exportable

Owners can export orders, customers, menu and transactions at any time.

GDPR and privacy.

Kelmo is an Irish company. For personal data processed on behalf of merchants, Kelmo acts as a processor under a data processing agreement. The Data Protection Commission (Ireland) is the lead supervisory authority.

Data processing agreement for merchants on request
Data access and erasure requests
Sub-processor list on request
Breach notification procedures

Make a data request

Ask for a copy of your data, or for it to be corrected or erased.

Data requests

AI and your data.

AI features work from your own trading data to produce briefings, forecasts and signals. Serious risk signals go to a person to review. See the AI Usage Limits page for allowances and fair use.

Report a vulnerability

Email hello@kelmo.ai with the subject "Security". Please do not test against live merchant data.