SolutionsSovereigntyCostGovernanceTry Kibo

Kibo / For privacy

GDPR, on time and on record.

Requests from individuals with their legal due date, breaches with the 72-hour deadline worked out for you, and a record of processing that finds its own gaps. Your privacy work is current and provable, not rebuilt when the authority asks.

Request a pilotMore examples
Sample conversation · a request for access
Lena · Privacy
Anna Weber asks for a copy of all the data we hold about her.
Kibo
This is an access request, due on 9 December: one calendar month from today. Her identity is not verified yet, so I can ask her to confirm it first.
Log privacy request PR-031
TypeAccessReceived9 NovemberDue9 DecemberHandlerLena Hoffmann
Log requestEdit
1 · What it is

Requests, breaches, processing and retention.

Kibo works on your requests from individuals, personal data breaches, record of processing, impact assessments and retention rules. The privacy team and the data protection officer ask in plain language; Kibo finds the request, the deadline or the gap and shows what it will change before it does.

Records it works on:

  • Privacy requests
  • Breaches
  • Processing activities
  • Impact assessments
  • Processors
  • Retention rules
  • Deletion log
2 · What it does

Deadlines worked out, not remembered.

A request gets its legal due date, with the extension rule built in. A breach gets its 72-hour authority deadline from the moment you became aware, and the decision to notify waits for the data protection officer. The record of processing lists its own gaps, and retention rules propose deletions that happen only after a yes.

Sample conversation · a breach
Lena · Privacy
A laptop with customer records was stolen this morning.
Kibo
I'll record it as a possible personal data breach, detected at 08:40 today. If it has to be reported, the authority deadline is Thursday at 08:40. The decision needs the data protection officer's approval.
Record breach B-004
DetectedToday, 08:40Authority deadlineThursday, 08:40Risk to peopleTo assessDecisionData protection officer
Record breachEdit
Sample conversation · the record of processing
Lena · Privacy
What is missing in our record of processing?
Kibo
Three activities have gaps. I can ask each owner to complete theirs.
Gaps in the record of processing
RecruitmentNo retention periodNewsletterNo legal basisPayrollProcessor not in the supplier register
Ask the ownersOpen the record
Policy

Approved once. Enforced every time.

Retention is a policy: what is kept, for how long, counted from which date, and who approves a deletion. It is approved once, versioned and enforced by code; every deletion is logged without the deleted values.

Sample policy
Retention: candidates not hired · version 1
Applies toCandidates with status rejectedKept for6 months after the decisionDeletion approved byThe data protection officerApproved byLena Hoffmann · 3 Oct
Last applied this morning: 4 records proposed for deletion, waiting for approval.
3 · Where it runs

Sovereign by design.

On your own servers, or hosted for you in a region of your choice, with an open-licence model. Requests, breaches and your record of processing are never sent to a third-party AI provider, and no telemetry is sent to anyone.

More: sovereignty · where Kibo runs · on-premise AI

4 · What it costs

Predictable cost.

The privacy team, the data protection officer and every record are included in the same annual licence as the rest of the company, with no per-seat, per-token or per-module pricing.

More: total cost of ownership

5 · Why trust it

An audit trail by construction.

Every change to a request, a breach or a processing activity is in the audit record with a name and a time. Only the privacy group sees these tables, and nothing is deleted, sent or changed without confirmation.

More: governance · security · policy as code

See it on your own processes.

Request a pilot