Security and your data
Last reviewed 3 October 2026 · Champions is operated by KALI App OÜ · [email protected]
Champions works on a list of people you already have a relationship with, which is usually the most sensitive list a revenue team owns. So this page is specific: what we need, where it sits, who can reach it, who else it touches, and how to get rid of it. Where we have not built something yet, it says so.
EU only
App, workers and database run in Frankfurt.
Three fields
Name, company, LinkedIn URL. The rest is optional.
Never pooled or sold
No training, no resale, no sharing between customers.
Delete it yourself
One person or the whole workspace, permanently.
1.What we actually need
Required for a contact to be tracked: first and last name, company, and a LinkedIn profile URL. That is the whole minimum.
Optional, and safe to leave out of your export: work email, deal value, revenue, owner, deal stage, dates, notes, and any other column. If your security team would rather you did not send work emails, do not send them. Tracking, fit scoring and plays all work without them; a play will simply show no email address.
Sample files: contacts.csv · accounts.csv.
2.Where your data lives
- The app, the background worker and the database all run in the EU (Frankfurt) on Render. Nothing is replicated to another region.
- Traffic to and from the app is HTTPS with HSTS. Data at rest sits on our hosting provider’s encrypted storage.
- Integration secrets get a second layer: HubSpot and Slack tokens and webhook signing secrets are encrypted by us with AES-256-GCM, using a key held outside the database. API keys and AI-agent tokens are stored only as SHA-256 hashes, so they cannot be read back out, by us or anyone else.
- To be precise: your contact fields themselves live in ordinary database columns, not individually encrypted. Protection at that layer is access control and the provider’s disk encryption.
3.Who can see it
- Your workspace. Members can read everything in the workspace, including exporting plays with email addresses. Admins additionally control settings, integrations, imports, API keys and deletion. There is no per-record or per-owner restriction yet, so invite the people who should see the whole list.
- Us. A small, named team can open a workspace to investigate a problem you have reported or an error we have detected. We will not pretend otherwise: a product like this cannot work on data nobody can look at.
- What we have not built yet: that staff access is not currently gated on your approval and not written to a log you can read. We are building both, and until they exist this is a contractual promise rather than a technical control. We would rather tell you that than claim a guarantee we cannot show you.
- Nobody else. No other customer, no partner, no advertiser.
4.Who else your data reaches
Everything we use to run the service, and exactly what each one receives:
| Who | Why | What reaches them |
|---|---|---|
| Render (EU) | Hosting: app, worker, database | Everything, stored in Frankfurt |
| Professional profile data provider | Checks whether a tracked person changed job | Only the LinkedIn profile identifier, and a company identifier. No names, no emails, no company names, no CRM fields. |
| Resend | Sends sign-in links and run summaries | Your users' own email addresses. Message bodies carry the workspace name and counts, never a tracked contact's name or email. |
| Stripe | Payments and invoices | Billing contact, amounts, workspace name. No contact data. |
And these, only if an admin in your workspace switches them on:
| Slack | Alerts in your own Slack workspace | Contact name, old and new role, and the suggested opener |
| HubSpot write-back | Writes job changes onto your own records | Into your own portal: name, title, company, email, and the job-change fields |
| Your webhooks | Pushes plays into your systems | Full play payload including email, to the URL your admin entered |
| AI agents (MCP) | An assistant you connect | Reads with your workspace's permissions; the agent vendor is your choice, not ours |
We will email workspace admins before adding anyone to the first table.
5.What we never do
- Train models on your data. We do not train models at all.
- Sell, rent or share your contacts.
- Pool your list with another customer’s. The one cache we share across customers holds public company information (industry, size, headquarters), never people.
- Contact the people on your list ourselves.
- Use your data for anything other than running your workspace.
6.Deleting it
- One person: Settings → Data & privacy, where you can find them by email, LinkedIn URL or name, or
DELETE /v1/contacts/{id}. Because we never require an email address, you can erase someone whose email we never held. This removes the contact and, when no other contact refers to the same person, every snapshot, position, detected change, play and email address we hold about them. - The whole workspace: type the workspace slug to confirm. Everything cascades.
- Both are immediate and permanent. We keep a deletion record: the fact, the time, who asked, and how many rows went. Nothing of the person remains in it.
- Retention, honestly: while your workspace exists we keep profile snapshots and the rows of the files you uploaded, so history and re-imports work. There is no automatic expiry yet. Ask us and we will purge them.
7.Signing in and access control
- Invite-only. No passwords exist: you sign in with a one-time link emailed to you. Sessions last 30 days.
- Two roles, admin and member, as described above.
- API keys are scoped to read or write, belong to exactly one workspace, can be revoked instantly and are stored hashed. AI agents connect over OAuth with PKCE and can be disconnected from Settings.
- Not available yet: SSO/SAML, SCIM, a second factor beyond the emailed link, and IP allowlisting. If your policy requires any of these, tell us and we will tell you honestly when we can have it.
8.Where we are on compliance
- GDPR. For the contacts you upload you are the controller and we are the processor, acting only on your instructions. Our privacy policy describes the processing; a DPA including standard contractual clauses is available on request.
- SOC 2: not yet. We will start the Type I programme when a customer’s procurement requires it, and we will update this page when it is underway. We would rather be boring and accurate here than imply an audit we have not had.
- Penetration test: not yet commissioned.
- Security questions during a review go to [email protected] and get an answer in writing, not a link to a portal.
Questions we are usually asked
- Can your staff read my customer list?
- Yes, a small named team can, in order to support you, and we do not yet have an access log to show you. That is the honest answer. What limits it today: access is restricted to that team, everything stays in the EU, and the contractual commitment is that we only look when there is a support reason. Consent-gated access with a log you can read is what we are building next.
- Do you use my list to help other customers, or to train AI?
- No. Your contacts are scoped to your workspace and are never pooled, sold or shared. We do not train models on customer data; we do not train models at all. The only thing shared across customers is a cache of public company information such as industry and headcount.
- What exactly do you send to third parties?
- To check whether someone changed job we send a LinkedIn profile identifier to our data provider: no names, no emails, no CRM fields. Email goes only to your own users, carrying counts rather than contact details. Stripe sees billing information only. Anything else, Slack, HubSpot, webhooks or an AI agent, happens only if your admin turns it on, and goes to your own systems.
- What happens when we stop using Champions?
- An admin can delete the workspace at any time and everything in it goes with it, permanently. If you would rather we did it, ask and we will, then confirm in writing. Your data is not retained for any other purpose.
- What if one of our contacts asks to be removed?
- Search for them in Settings by email, LinkedIn URL or name, check the match, and delete. Email is optional on a contact, so someone whose email we never held can still be found and erased. The contact and everything we hold about that person goes, and the deletion is logged so you can evidence it to the person who asked. The same thing is available through the API.
Reviewing us right now? Email [email protected] with whatever your process needs: a DPA, a filled-in security questionnaire, or a call where we delete a test contact live so you can watch it happen. If the answer is “we have not built that yet”, that is what you will get.