Compliance & Security
Researchers trust Kahubi with unpublished work and participant data. Here is exactly how we handle it — in plain language.
Never used to train models
Your papers, unpublished manuscripts, datasets, and interview recordings are used exclusively to fulfill your requests. We do not train AI models on your content, and our AI subprocessors are used via API agreements that exclude training on customer data.
GDPR-compliant by design
Kahubi is operated by Avidemic AB, a Swedish company subject to the GDPR. We collect only what the service needs, document our subprocessors below, and act on data-subject requests — access, correction, export, and erasure.
EU processing for transcription
Interview audio and video are transcribed through AssemblyAI’s dedicated EU endpoint, so recordings of research participants are processed within the European Union — a hard requirement for many ethics approvals, and a default in Kahubi.
Encrypted credentials at rest
Integration tokens (Zotero, Mendeley, GitHub) are encrypted at rest with application-level encryption and displayed only in masked form after you save them.
Private by default
Everything you put into Kahubi is private to your account unless you explicitly share a project with your team. There are no public profiles, no ads, and we never sell data — the subscription is the business model.
Deletion on request
You can export your library (BibTeX, RIS, CSL-JSON) and your manuscripts (.tex, .docx, PDF) at any time. Request account deletion and we remove your account and associated content from our systems, confirming when it is done.
Subprocessors
We use a small, documented set of subprocessors, each limited to a single purpose. Your content is shared with them only to the extent required to deliver the feature you are using.
| Provider | Purpose | Notes |
|---|---|---|
| OpenAI / Microsoft Azure OpenAI | AI text generation and analysis (chat, writing, statistics interpretation) | API traffic excluded from model training under provider terms |
| AssemblyAI (EU endpoint) | Speech-to-text transcription of interview audio/video with speaker labels | Processed in the European Union |
| Stripe | Payment processing and subscription billing | PCI-DSS Level 1 certified; we never store card numbers |
| SMTP2GO | Transactional email (verification, invitations, support replies) | Email metadata only — no research content is sent by email |
| Mixpanel (EU) | Product analytics — feature-usage events so we can improve Kahubi | EU data residency; no research content, no ads, never sold. On the public website it runs only with your consent. |
Security contact
Found a vulnerability, or need a Data Processing Agreement, subprocessor notifications, or answers for your institution's ethics board? Write to us at team@kahubi.com and we will respond promptly. Please include enough detail for us to reproduce or assess the issue.
Compliance questions answered, work to do
Start on the free plan — your data is handled the same way on every tier.