Teams that check identities, take payments or handle health questions answer customers in the same channels as everyone else: email, website chat, WhatsApp, Telegram. What differs is the data that arrives. A customer sends a photo of a passport, a bank statement or a proof of address, and the support desk becomes a place where that data is stored, copied and read. KYC and AML rules in financial services, FICA in South Africa, licence conditions for gambling operators, and health-privacy laws all ask the same three questions of that place: who can see it, who did see it, and when it goes away.
This guide shows how Kommio answers each one, and what it does not do yet.
Who can see it: three modes per kind of data
Every personal field in Kommio carries a tag, and every role has a mode per tag:
| Mode | What the person sees |
|---|---|
| Visible | The value in full |
| Masked | Part of it: m•••@example.com, •••• 3000 for payment details, ••• for an ID document |
| Hidden | Nothing; the app says “Hidden for your role” |
The tags cover email addresses, phone numbers, postal addresses, ID documents, payment details, private notes, team members’ email addresses and IP addresses (the website chat visitor’s address and the one in the audit log). Roles are set in Settings › Roles, together with what the role may do and which conversations it sees: all of them, those of its teams, or only those assigned to it.
The mode holds everywhere a value leaves the server for a person: conversation and contact pages, lists, search results, the change history, audit log snapshots, exports, and the delivery logs of webhooks and bots. A person cannot get around it with a reply placeholder (a reply that would insert a value they see masked is refused) or with a filter that matches on a value they may not see.
Custom attributes that hold ID and bank numbers
Help desks that check identities often keep an ID number, a bank account or a tax number in a custom attribute. Mark it in Settings › Custom attributes › Sensitivity as an email, phone, address, ID document or payment detail, and from then on it follows each role’s grant for that tag exactly like the built-in fields. Each change of a sensitivity is audited.
A person who sees an attribute hidden cannot write it. A person who sees it masked can set a new value but cannot overwrite the stored one with the masked text by saving a form.
ID documents and other files
A file on a message, such as a passport photo or a bank statement, can carry the same tags. An agent marks it from the thread with the shield beside the file, or a rule or macro marks every unmarked file of a conversation with the action Mark the files as personal data, which suits an inbox where customers send their documents. Changing or removing a mark needs to see that kind of data in clear, so nobody can unmask a file for themselves.
Once marked:
- Visible: the file with its mark; a marked image is never previewed inline, it is opened on purpose.
- Masked: the thread shows the kind and size of the file, without its name, link or preview. A holder of the reveal permission can open it through a link that works for ten minutes and only for them, and the reveal is audited.
- Hidden: a locked placeholder that cannot be revealed.
- AI: never named to or sent to an AI provider.
- Exports: a conversation export lists the file only for someone who sees its kind in clear.
- Erasure: deleted with the contact’s erasure, whoever sent it, including a copy the team attached to a reply.
Who did see it: reveals, access and the audit trail
Audited reveal. A masked value can be revealed in full only by a role with sensitive:reveal, one field of one record at a time, with an optional reason. Each reveal writes an audit entry with who, which field of which record, the kind of data, the reason and the address. A hidden value cannot be revealed.
Who revealed what. Settings › Security policy shows the last 30 days of reveals per person, with a link into the audit log filtered to them. It is the page to read in a weekly review.
Access overview. Settings › Access answers, for every member, disabled member and pending invitation, which conversations they see in each inbox, what they may do with them, and how they see each kind of personal data, with the reverse views (who sees this inbox, who sees ID documents in clear) and a CSV export for an auditor. Supervisors get a reduced view of the inboxes they oversee and the people in them, without the field modes or the export.
Audit trail. Every change records who, what, before and after. When a customer’s own website updates a contact’s name or email at sign-in, that change is recorded too.
The raw email. Every inbound email is also kept exactly as it arrived, for 90 days by default (a workspace setting), for a dispute or a second look. Only a person who manages inboxes and may read the whole message in clear can download it, and each download is audited.
When it goes away: retention and erasure
Conversations are kept as long as the workspace exists. The rest follows retention settings with floors for security data:
| Setting | Default | Floor |
|---|---|---|
| Audit log | 365 days | 90 days |
Files marked as ID documents (retention.identity_docs_days) |
0 (keep) | 1 day, at most 3650 |
| Raw copy of inbound emails | 90 days | 1 day |
| Website visitor context | 365 days | 1 day |
| Sessions of signed-in visitors who never wrote | 30 days | 1 day |
Erasure (the GDPR request) removes what the customer wrote: message content, their files, email headers such as to and cc, rating comments and the pages they visited, and every file marked as personal data whoever sent it. The team’s replies, notes and activity lines stay as the business’s records, with the customer’s name, email addresses and phone numbers replaced by [erased]; audit rows stay with their values replaced; finished export files that could name the customer are withdrawn. Erasing more than one contact shows an impact preview first and asks for the number to be typed. Messages already delivered to the customer’s channel, bodies other systems already received by webhook, and backups are outside its reach.
AI and personal data
AI assist and the AI agent are off until an administrator turns them on, either on Kommio Cloud’s free AI allowance, where Anthropic processes the requests as Kommio’s sub-processor, or with the workspace’s own provider key, where the provider works under the workspace’s own agreement with it. Values tagged as payment details or ID documents are never sent, card numbers typed into messages are removed before a call, custom attributes are never sent, and the AI agent is sent no email addresses or phone numbers. Kommio stores no prompts or answers, only usage counts for the budget.
Setting it up, step by step
- Draw the roles. In Settings › Roles, give front-line agents email and phone masked, ID documents and payment details hidden or masked, and no reveal permission. Give the compliance or verification team ID documents masked with
sensitive:reveal, so every look is recorded. - Tag the attributes. In Settings › Custom attributes, set the sensitivity of every attribute that holds an ID number, bank account or tax number. Moving from Chatwoot, the import report names the attributes whose key or name looks like one, so you can mark them before agents start.
- Mark files automatically. Create a rule on the inbox or channel where customers send documents, with the action Mark the files as personal data. Agents can still mark a file by hand from the thread.
- Set retention. In Settings › Privacy, set
retention.identity_docs_daysto the period your rules require, and check the audit log and raw email periods. - Check access. Open Settings › Access, look at who sees ID documents in clear, and export the CSV for your records.
- Review reveals weekly. Read Settings › Security policy and follow any unusual reveal into the audit log.
What Kommio does not do yet
- Values a customer already typed into the text of a message (an ID number in a chat line) are not masked; only card numbers are removed before AI calls.
- Audit retention per regulation (for example five years), report data kept beyond 400 days, and anonymisation of conversations after a number of years of inactivity are planned, not shipped.
- A vault that masks fields at ingest is deferred; masking is applied to every value that leaves the server instead.
- Virus scanning of files is a self-hosted option; Kommio Cloud does not scan files yet.
Frequently asked questions
Can an agent see a customer's ID number without it being logged?
No. A role either sees a kind of data in clear, masked or not at all. Revealing a masked value needs the sensitive:reveal permission, works one field of one record at a time, takes an optional reason and writes its own audit entry. Settings › Security policy lists who revealed what in the last 30 days.
Are ID documents sent to the AI features?
No. A file marked as an ID document or other personal data is neither named to nor sent to an AI provider, whoever asks and whatever the AI settings allow for attachments. Values of attributes tagged as payment details or ID documents are cut from every transcript, and AI assist and the AI agent are off until an administrator turns them on.
How long does Kommio keep ID documents?
As long as you choose. The setting retention.identity_docs_days (Settings › Privacy) is 0 by default, which keeps them; set it to a number of days, up to 3650, and files marked as ID documents are deleted that many days after upload. Erasing a contact deletes every file marked as personal data, whoever sent it.
Can Kommio keep the audit log for five years?
Not yet. The audit log is kept 365 days by default, with a floor of 90 days, as a workspace setting. Audit retention per regulation (for example five years) and anonymisation after a number of years of inactivity are planned on the roadmap, not shipped.
What happens to a conversation when a customer asks to be erased?
What the customer wrote goes: message content, their files, email headers, rating comments, the pages they visited. The team's replies, private notes and activity lines stay as the business's records, with the customer's name, email addresses and phone numbers replaced by [erased]. Audit rows stay with their values replaced, and finished export files that could name them are withdrawn.
Facts on this page describe Kommio as it is on the date above; anything marked planned is on the roadmap, not shipped. Corrections to [email protected].