Skip to main content
Reviewers ask the same questions before they let a team turn Keldyn on. The answers below cover the web app and the Keldyn MCP server (“KC”). KC is a tooling interface. Every call it makes hits the same authenticated Keldyn API as the web app, under the signed-in user’s token. Same rules either way. Certification dates, the subprocessor list, and audit status move. Those live on the Trust Center, not in a paragraph that goes stale. If your organization has published its own center, use that URL for your contract. Keldyn’s is at trust.keldyn.ai/keldyn. How a center gets published, and the logo files on Keldyn’s page, are in Trust Center.

​
Is anything sent to KC used to train models?

No. Prompts, tool inputs, and governance data that an AI feature or a KC tool call processes are used to serve that request. Keldyn does not train or fine-tune any model on customer content. Oversight and who can read AI artifacts are in AI data handling.

​
Where is data processed and stored, and under which jurisdiction?

The application, API, and MCP server run on cloud hosting operated by companies based in the United States. The primary database is managed PostgreSQL. Data you send, in the app or through KC, is processed and stored there. Not every AI feature calls a model provider. A coding-agent review, and the evidence-collection prompts, run on your own model. Keldyn’s model is not in that path. Two Keldyn-side calls do leave the app: the architecture summary written when an architecture is saved, and the changed lines of a pull request when the PR Review Bot runs. Those go through an AI inference gateway to a model provider, for that request only, and are not used for training. Data flow names what is sent, the provider, the region, and what is kept. Regions and any residency commitment on your contract are on the Trust Center. Infrastructure moves; a copied region list here would lie.

​
Which subprocessors are involved when KC runs?

A typical KC request, and the same actions in the web app, involve these subprocessors: That is the data path for a typical KC request. The Trust Center is the current list for your contract. Check it before you paste this table into a questionnaire.

​
What is Keldyn’s role under GDPR, and is a DPA available?

For the governance, risk, and compliance data your organization puts into Keldyn, including data submitted through KC, Keldyn is a data processor. Processing follows your organization’s instructions. Your organization stays the data controller. For the account data needed to run the Keldyn account itself (billing, login), Keldyn is a controller. A Data Processing Addendum (DPA) exists. Ask your Keldyn representative, or request it through the Trust Center, and get the current version signed for your organization.

​
Which attestations does Keldyn hold?

Keldyn does not yet hold a completed third-party attestation such as SOC 2 or ISO 27001. Those are on the roadmap. The Trust Center is where current status lives, including anything in progress. Use that page. A sentence here will be wrong the week a report lands.