Karma secure:
protecting what matters

Our commitment

• 

  Privacy

  Your privacy is sacred. We adhere to global standards like GDPR and CCPA, making your data's confidentiality our top concern.

• 

  Security

  We blend security into our operations and product design, using the best practices to protect your data.

• 

  Reliability

  Expect unwavering reliability. Our scalable infrastructure and transparent performance updates mean you're always in the loop.

Security information:
Karma for Web

• Secure data transmission and encryption

  Karma’s web application enforces end-to-end encryption across all user interactions, ensuring data is protected both in transit and at rest. All communications between users and Karma’s servers use TLS 1.3 with modern cipher suites, protecting against interception, tampering, and man-in-the-middle attacks. Stored data benefits from AES256 encryption, providing long-term protection at both the application and hardware levels, with multi-layered key management to further enhance security.

• Proactive vulnerability management

  Karma integrates security best practices directly into its development lifecycle, including continuous code reviews, automated security scanning, and regular penetration testing. The web app infrastructure is fully containerized, ensuring each service is isolated to minimize the risk of lateral movement during potential incidents. Vulnerabilities are triaged, prioritized, remediated, and retested on a rolling basis to maintain a resilient security posture in line with industry best practices.

• Access control and user permissions

  Karma’s web app adheres to the principle of least privilege, ensuring users only have access to the data and features necessary for their role. Admin users can configure granular permissions, controlling access to sensitive areas such as data exports, billing, and administrative tools. All login attempts, account changes, and high-risk actions are logged and continuously monitored to detect potential anomalies. Periodic access reviews further enhance security by ensuring permissions remain appropriate over time.

• User privacy and data control

  Users have full control over their personal data in the Karma web app, with the ability to request data deletion or anonymization directly via their profile settings. Karma’s data retention policy ensures unnecessary data is automatically purged after predefined periods, minimizing exposure. All deletion requests follow a multi-step verification process, confirming user identity before securely erasing or anonymizing data. These processes ensure full compliance with GDPR, CCPA, and other relevant data protection regulations, offering users transparency, security, and peace of mind.

Security information:
Karma for Slack

• Data retention and removal policy

  Karma for Slack follows a strict data retention policy, balancing functionality with privacy. All team data is securely erased 30 days after a workspace fully deletes the bot, ensuring no unnecessary data remains. Customers can also instantly purge all team data using the Billing page > Danger zone option, offering complete control over their information. To protect user privacy, individual profiles are anonymized upon deletion, preserving historical data integrity without retaining personal details. Automatic data shredding processes run daily, ensuring obsolete records are securely removed on schedule.

• Data encryption and storage security

  Karma employs industry-standard encryption protocols to safeguard your Slack workspace data. All data in transit is secured using TLS 1.3, AES256 encryption, and SHA2 signatures, ensuring safe and tamper-proof communication between your workspace and Karma’s servers. Data at rest benefits from AES256 encryption with layered protection at both the storage system and device levels, offering robust defense against unauthorized access. Our infrastructure, hosted on AWS and DigitalOcean in the United States, also leverages Cloudflare’s advanced security services to mitigate external threats and enhance resilience.

• Infrastructure and network protection

  Karma’s production environment is secured using DigitalOcean Cloud Firewalls, allowing only traffic from explicitly whitelisted IP addresses and blocking all unauthorized access. Internal systems are continuously monitored for suspicious activity, with strict access controls ensuring only authorized personnel can interact with sensitive data. Combined with hardware RAID configurations and comprehensive backup procedures, these controls ensure data availability and resilience, even in the event of hardware failures or service disruptions.

• Compliance, deletion requests & user control

  Karma prioritizes user control and regulatory compliance. Workspace admins and owners can initiate immediate, irreversible data deletion directly from the app’s settings. Individual users can also request the anonymization or deletion of their personal data at any time. Every request triggers a verified support process, confirming the requester’s identity before securely processing the request. While Karma is not HIPAA-compliant, our data handling practices align with GDPR and CCPA principles to ensure transparency, accountability, and user control.

• Slack Enterprise Grid support

  Karma works on Slack Enterprise Grid. It is installed per workspace: each workspace in your Grid organization gets its own Karma settings, leaderboards and subscription. Org-wide installation across all workspaces at once is not supported. Your org admin may need to approve the app first.

• Slack Connect channels

  Karma works in Slack Connect channels. Members from other organizations are treated as guests: they can give and receive karma, and they are never counted in your bill. Reports can exclude external shared channels.

• Single sign-on (SSO)

  You sign in to the Karma dashboard with your Slack account (Sign in with Slack), so your company's Slack SSO and two-factor policies apply. There is no separate SAML setup.

Security information:
Karma for MS Teams

• Microsoft 365 security and compliance alignment

  Karma for Microsoft Teams is a Microsoft Publisher Attested App, meaning it meets Microsoft’s rigorous security and compliance requirements for Teams applications. Karma undergoes annual PCI DSS assessments and holds CSA STAR certification, demonstrating our commitment to safeguarding customer data. Karma also complies with global data protection laws, including GDPR and CCPA, ensuring transparent data handling and robust privacy protections. All data transmitted between Teams clients and Karma services is encrypted using TLS 1.1+, providing a secure communication channel across your Microsoft collaboration environment.

• Data handling and transmission control

  Karma for Microsoft Teams follows the principle of least privilege, limiting access strictly to the data necessary for functionality. When required for core features, the app may access specific personal information (e.g., phone numbers, postal addresses, URLs) within active messages — however, Karma cannot read or modify other mailbox items. Any data transmitted to third-party services follows strict encryption standards, ensuring secure handling. By applying data minimization practices, Karma reduces the exposure and retention of personal data.

• Advanced security best practices

  Security is embedded into Karma’s development lifecycle through secure coding practices, regular security reviews, vulnerability scanning, and continuous testing at every development stage. Karma’s production environment is continuously monitored, with all systems operating under segmented, firewall-protected networks to minimize risk. Regular penetration testing, combined with real-time anomaly detection and multi-layered access controls, ensures Karma maintains a strong security posture aligned with Microsoft’s evolving security standards.

• User control and data privacy

  Karma puts data control in the hands of Teams admins and users. Admins can configure permissions and manage access directly within the Microsoft 365 Admin Center, tailoring access rights to specific roles and data sensitivity levels. All user data is processed under strict data retention and deletion policies, and users can request their personal data be deleted or anonymized at any time. Each request undergoes a verified multi-step process, ensuring requester identity is confirmed before secure processing. By combining robust data controls with adherence to GDPR and CCPA, Karma ensures transparency, privacy, and user empowerment across your Teams environment.

Security information:
Karma for Telegram

• End-to-end encryption and data transmission

  Karma for Telegram ensures secure message exchange by leveraging Telegram’s infrastructure, which uses MTProto encryption for client-server communication. All bot communications are encrypted in transit via HTTPS/TLS, protecting against interception or tampering. Karma never stores message content beyond what is necessary for feature delivery, and no messages are accessible to third parties outside Telegram’s own infrastructure.

• Minimal permissions and data handling

  Karma follows the principle of data minimization, requesting only the minimum required permissions to function. The bot does not access contact lists, group histories, or user metadata beyond what is essential for operations. All data handled via the bot is processed ephemerally — Karma does not retain user messages unless explicitly required for scoring, reporting, or analytics functions, and even then only temporarily.

• Hosting, isolation and bot infrastructure

  Karma’s Telegram bot backend runs in containerized, sandboxed environments hosted on DigitalOcean and AWS infrastructure in the United States. Each bot instance is isolated to reduce attack surface and limit blast radius in case of incident. Firewalls and automated threat detection systems help mitigate unauthorized access attempts, and all backend services operate over secure, whitelisted channels only.

• User control and bot privacy

  Users and group admins have full control over the Karma bot’s presence. The bot can be removed at any time, and users can request data removal through direct support or automated in-app flows. All requests undergo identity verification before secure deletion or anonymization is completed. Karma’s data practices comply with GDPR and CCPA principles, offering privacy by design and user autonomy at all times.

Our defenses: strong and smart

• 

  Firewall protection

  With DigitalOcean cloud firewalls, we carefully filter traffic, allowing only whitelisted IP addresses and blocking unauthorized access.

• 

  Data encryption

  Advanced encryption protocols such as TLS 1.3, X25519 and AES_128_GCM protect your data both in transit and at rest.

• 

  Data resilience

  Our servers are protected against data loss, with backup plans in place that include hardware RAID and strict backup procedures.

• 

  Performance monitoring

  We closely monitor the health of our system, ensuring optimal performance around the clock with DigitalOcean Monitoring.