Last updated: 28 September 2026
This is an overview of the services and key software libraries that run Klai. It lists software projects, rather than every container instance or indirect dependency. Some external providers are sub-processors under GDPR. Self-hosted software runs on our infrastructure; its maintainers do not become sub-processors simply because we use their software. Where a service sends data to an external provider, we describe that separately.
The GDPR-specific sub-processor list is at /docs/legal/sub-processors.
Hosting & networking
| Tool |
What it does |
Location |
Sub-processor |
| Hetzner Online GmbH |
German hosting provider. Our servers run in their data centers in Finland and Germany. Hosts all Klai data. DPA accepted 7 March 2026. See sub-processor detail. |
Finland, Germany (EU) |
Yes |
| Hetzner DNS |
DNS provider for getklai.com. Manages DNS records only. No customer data is processed. |
Germany (EU) |
No |
| Let’s Encrypt |
Free, automated TLS certificate authority. Issues our HTTPS certificates via the ACME protocol. No customer data is processed. |
USA |
No |
| Cloud86 |
Dutch hosting and email provider. Manages Klai’s business email and acts as SMTP relay for transactional emails sent by Klai. Processes recipient email addresses and first names in transit. DPA signed. |
Netherlands (EU) |
Yes |
These run on our own Hetzner servers. External hosting and email providers are listed separately above.
| Tool |
What it does |
| Docker |
Open source container runtime. All Klai services run as Docker containers on our own infrastructure. |
| NGINX |
Open source web server and load balancer. Distributes requests across our transcription workers on our infrastructure. |
| socat |
Open source network relay. Connects internal services, including the meeting transcription service, on our infrastructure. |
| Caddy |
Open source reverse proxy and web server. Handles HTTPS termination, serves our public websites, and routes traffic between internal services. |
| Zitadel |
Open source identity provider. Manages user accounts, authentication (OIDC), and access control. Stores account credentials and session data on our own infrastructure. |
| SOPS + age |
Open source secrets management. All infrastructure secrets (API keys, passwords) are encrypted with age and stored as SOPS-encrypted files in our private Git repository. |
| docker-socket-proxy |
Open source proxy by Tecnativa. Provides restricted container access and read-only service discovery, alongside Klai’s own container authorization service. Runs on our infrastructure. |
| Fail2ban |
Open source intrusion prevention. Monitors server logs and blocks IP addresses that show signs of abuse. |
Databases & storage
All databases run on our own Hetzner servers. Customer data stays in our infrastructure.
| Tool |
What it does |
| PostgreSQL (with pgvector) |
Open source relational database. Stores user accounts, tenant configuration, portal data, and the portal API state. The pgvector extension adds vector search support. |
| MongoDB |
Open source document database. Stores chat conversations per tenant. Each tenant has a separate database. |
| Redis |
Open source in-memory data store. Used for caching, session management, and message queuing. |
| RabbitMQ |
Open source message broker. Used internally by Firecrawl to queue web scraping jobs. |
| Meilisearch |
Open source full-text search engine. Indexes chat messages so users can search their conversation history. |
| Qdrant |
Open source vector database. Stores document embeddings for semantic search over uploaded documents. |
| FalkorDB |
Open source graph database. Stores the knowledge graph of entities and relationships extracted from uploaded documents. Used alongside semantic search to find conceptually connected information when the AI answers questions. Runs on our own infrastructure. |
| Garage |
Open source distributed S3-compatible object storage by Deuxfleurs. Stores images extracted from documents and other binary artefacts produced by the knowledge ingest pipeline. Runs on our own infrastructure. |
Monitoring & observability
All monitoring runs on our own infrastructure. Log and metric data stays on our servers.
| Tool |
What it does |
| VictoriaMetrics |
Open source time series database. Stores operational metrics (CPU, memory, request rates) with 30-day retention. |
| VictoriaLogs |
Open source log storage. Operational logs have 30-day retention and may contain IP addresses and request metadata. When full telemetry is enabled, content logs can include query text and are stored separately with 7-day retention. Both stores run on our infrastructure. |
| Grafana |
Open source monitoring dashboard. Visualises metrics and logs from VictoriaMetrics and VictoriaLogs. Access restricted to Klai staff via authentication. |
| Grafana Alloy |
Open source metrics and log collector. Forwards Docker container logs and node metrics to VictoriaMetrics and VictoriaLogs. |
| cAdvisor |
Open source container resource monitor. Collects CPU, memory, and network metrics per container. |
| GlitchTip |
Open source error tracking (Sentry-compatible). Captures application errors to help us diagnose and fix problems. Runs on our own infrastructure. |
| Uptime Kuma |
Open source uptime monitor. Checks whether our services are running and alerts us when they are not. |
| Umami |
Open source privacy-friendly website analytics. Cookieless, GDPR-compliant by default. Tracks pageviews and custom events on getklai.com. No personal data is collected. Runs on our own infrastructure. |
AI product
| Tool |
What it does |
| LibreChat |
Open source AI chat interface. This is the product interface customers use to interact with AI models. Conversation history is stored on our own infrastructure. Content needed to generate an answer is sent through LiteLLM to the inference provider described below. |
AI inference & models
| Tool |
What it does |
Location |
Sub-processor |
| LiteLLM |
Open source AI gateway. Routes chat inference requests to Mistral. The gateway runs on our own infrastructure. |
Klai infrastructure |
No |
| Ollama |
Open source software for running language models locally. An Ollama service runs on our own infrastructure. It is currently not configured as automatic failover for Mistral in the chat gateway. |
Klai infrastructure |
No |
| Mistral AI SAS |
French AI company whose models we use for inference. Receives only the API call content: the query and any uploaded documents. No account data. Not retained. Not used for training. DPA accepted 7 March 2026. See sub-processor detail. |
France (EU) |
Yes |
| Hugging Face TEI (Text Embeddings Inference) |
Open source inference server for embedding models. We run it locally with the BAAI/bge-m3 model to generate dense vector embeddings from documents. Nothing leaves our servers. |
Klai infrastructure |
No |
| FlagEmbedding |
Open source embedding library. We run it locally as a sparse-embedding sidecar (BAAI/bge-m3 sparse) because TEI does not yet support BGE-M3 sparse output. Nothing leaves our servers. |
Klai infrastructure |
No |
| Infinity |
Open source reranking server. We run it locally with the BAAI/bge-reranker-v2-m3 model to rerank search results. Nothing leaves our servers. |
Klai infrastructure |
No |
| SearXNG |
Open source privacy-respecting metasearch engine. Powers web search in the chat interface and the research feature. Runs entirely on our own infrastructure. Queries are not sent to commercial search APIs. |
Klai infrastructure |
No |
| Vexa |
Open source meeting and transcription services. Meeting bots join video calls on behalf of the user; meeting management and speech-to-text services run on our infrastructure. Audio is transcribed locally using Whisper. |
Klai infrastructure |
No |
| Presidio |
Open source personal-data detection and masking framework, originally developed by Microsoft and now maintained by Data Privacy Stack. We run its analyzer and anonymizer locally. Detection and masking depend on the configured processing path; this does not guarantee that all personal data is removed before inference. |
Klai infrastructure |
No |
| langid.py |
Open source language identification library by Marco Lui and Timothy Baldwin. Detects the language of incoming chat messages and uploaded documents so we route them to the right prompt and embedding pipeline. Runs on our own infrastructure. |
Klai infrastructure |
No |
| Graphiti |
Open source knowledge graph framework by Zep. Extracts entities and relationships from uploaded documents and stores them in FalkorDB. The extraction step calls the language model through LiteLLM, so document text is sent to Mistral as described above. The framework itself runs on our own infrastructure. |
Klai infrastructure |
No |
| UMAP |
Open source dimensionality reduction library. Used in the knowledge ingest pipeline to project document embeddings for clustering. Runs on our own infrastructure. |
Klai infrastructure |
No |
| Ragas |
Open source RAG evaluation framework by VibrantLabs. Scores retrieval quality and answer faithfulness on our own evaluation set so we can measure regressions before they reach production. Runs on our own infrastructure. |
Klai infrastructure |
No |
Document & audio processing
Document extraction and audio transcription run on our own servers. Extracted text or transcripts may be included in requests to Mistral when needed to answer a question, as described above.
| Tool |
What it does |
| Whisper |
Open source speech-to-text model developed by OpenAI, run with faster-whisper by SYSTRAN. Powers the transcription feature. Audio is processed entirely on our own infrastructure. |
| docling |
Open source document conversion tool. Converts uploaded PDF and DOCX files to text so AI models can read them. Runs on our own infrastructure. |
| Unstructured.io |
Open source document parser. Used by our connector service to extract text from uploaded PDF, DOCX, and HTML files before they enter the knowledge pipeline. Runs on our own infrastructure. |
| Crawl4AI |
Open source web crawler. When you connect a website as a knowledge source, Crawl4AI fetches and extracts the pages so the AI model can read them. Runs entirely on our own infrastructure. |
| Firecrawl |
Open source web scraper. When you use web search in the chat interface, Firecrawl fetches and extracts the full text of web pages so the AI model can read them. Runs entirely on our own infrastructure. |
| Tool |
What it does |
Sub-processor |
| Fider |
Open source feature voting and roadmap software. If you submit a request or vote, your email is stored on our own infrastructure and stays safe with us. |
No |
| Listmonk |
Open source mailing list and campaign manager. Stores recipient names, email addresses and subscription preferences on our infrastructure. Email delivery uses Cloud86, listed above as a sub-processor. |
No |
| Twenty |
Open source CRM. We use it to manage customer relationships. Runs on our servers. Your contact details stay with us. |
No |
| Calnode |
Open source scheduling software. When you book a meeting with us, your name, email, and chosen time are stored on our own infrastructure. Apache-2.0, runs entirely on our servers. |
No |
| Vaultwarden |
Open source Bitwarden-API-compatible password manager. Stores our own infrastructure admin credentials (Grafana, Cloud86, etc.). Runs on our servers. Holds no customer data. |
No |
Payments
| Tool |
What it does |
Location |
Sub-processor |
| Moneybird B.V. |
Dutch accounting and billing platform. Handles subscriptions, invoicing, and SEPA direct debit. Processes billing contact data including IBAN, KvK, and VAT number. DPA signed 7 March 2026 (v1.2). See sub-processor detail. |
Netherlands (EU) |
Yes |
Development & source control
| Tool |
What it does |
| GitHub |
Source code hosting and CI/CD. Stores Klai’s application code under the GetKlai organisation. No customer data is stored here. |
| Gitea |
Open source self-hosted Git service. Used as the backend for the knowledge base. Documents you publish via the knowledge base editor are stored here as Git-managed files on our own infrastructure. |
| uv |
Open source Python package manager and project tool. Used to manage backend dependencies and virtual environments. |
| ruff |
Open source Python linter and formatter. Enforces code style and catches common errors in backend code. |
| pyright |
Open source Python type checker developed by Microsoft. Validates type correctness in backend code. |
| pre-commit |
Open source git hook framework. Runs ruff, pyright, and pip-audit automatically before each commit. |
| Renovate |
Open source dependency update bot. Each Monday at 05:00 Amsterdam time it checks every library, Docker image, and GitHub Action we use against its registry and raises a pull request for anything outdated. Patches merge themselves; majors get a human review. |
| Playwright |
Open source end-to-end browser test framework by Microsoft. Drives the klai-portal through real browsers (Chromium, Firefox, WebKit) in CI to catch regressions before they reach customers. |
| agent-browser |
Open source AI-driven browser CLI by Vercel Labs. Drives a real browser through natural-language instructions. We use it alongside Playwright for exploratory end-to-end checks of the portal and the website where the AI tolerates UI drift better than fixed selectors. |
Security scanning
We run a defence-in-depth stack of independent scanners so a vulnerability caught by one is backed up by another. Findings go to the GitHub Security tab; critical issues block the build. No customer data is processed by any of these tools.
| Tool |
What it does |
| pip-audit |
Open source Python dependency vulnerability scanner. Checks for known CVEs in backend dependencies before each commit. |
| npm audit |
Built into npm. Scans frontend dependencies for known CVEs on every build. Blocks the build on HIGH or CRITICAL findings. |
| Trivy |
Open source container security scanner. Scans our own Docker images during CI/CD, plus a weekly scan of every third-party image we depend on (Postgres, Redis, Grafana, and about twenty others). |
| Semgrep |
Open source static analysis for security. Scans backend and frontend code on every push and pull request for known vulnerability patterns (SQL injection, XSS, hardcoded secrets, unsafe deserialisation). |
| GitHub Dependabot security updates |
GitHub’s built-in security feature. Auto-opens a pull request the moment a CVE fix becomes available for one of our Python or Node dependencies. Independent of Renovate’s weekly schedule. |
| GitHub secret scanning + push protection |
GitHub’s built-in scanner. Blocks pushes that contain credentials (API keys, tokens) so accidents never reach the public repository. |
Frontend libraries
The portal and website are built with the following open source libraries.
| Library |
What it does |
| React |
Open source UI library. Powers the klai-portal customer interface. |
| Vite |
Open source frontend build tool. Bundles and serves the portal frontend. |
| TanStack Router |
Open source type-safe client-side router for the portal. |
| TanStack Query |
Open source data fetching and caching library for the portal. |
| TanStack Table |
Open source headless table library for the portal. |
| Tailwind CSS |
Open source utility-first CSS framework. Used across portal and website. |
| Mantine |
Open source React component library. Used for UI primitives in the portal. |
| Radix UI |
Open source headless UI component library. Used for accessible interactive components in the portal. |
| BlockNote |
Open source rich text editor. Powers the knowledge base editor in the portal. |
| Paraglide JS |
Open source compiler-based i18n library. Handles Dutch/English translations in the portal with zero runtime overhead. |
| Lucide React |
Open source icon library. All icons used in the portal and website come from here. |
| Astro |
Open source web framework. Powers the getklai.com website. |
| Keystatic |
Open source Git-based CMS. Used to manage website content (blog posts, pages) without a database. |
| Next.js |
Open source React framework. Powers the klai-docs documentation site. |
| SolidJS |
Open source reactive UI library. Powers the embeddable Klai chat widget that customers can place on their own websites. |
| marked |
Open source Markdown parser. Renders assistant messages in the Klai chat widget. |
| DOMPurify |
Open source HTML sanitiser by Cure53. Cleans every rendered message in the chat widget before it is shown. |
Backend libraries
The portal API (FastAPI, Python) is built with the following open source libraries.
| Library |
What it does |
| FastAPI |
Open source Python web framework. The entire klai-portal API is built on it. |
| Uvicorn |
Open source ASGI server. Runs the FastAPI application in production. |
| SQLAlchemy |
Open source Python ORM. Handles all database queries and schema management. |
| Alembic |
Open source database migration tool. Manages PostgreSQL schema changes. |
| Pydantic |
Open source data validation library. Validates and serialises all API request and response data. |
| asyncpg |
Open source async PostgreSQL driver. Powers database connections from the portal API. |
| Procrastinate |
Open source PostgreSQL-based job queue. Handles debounced knowledge-ingest tasks and other background work on our own infrastructure. |
| cryptography |
Open source Python cryptography library. Used for encryption operations in the portal API. |
| MCP Python SDK |
Open source SDK for the Model Context Protocol. Powers klai-knowledge-mcp, the bridge that lets chat assistants query the knowledge base. |
| Jinja2 |
Open source templating engine. Renders transactional email bodies in klai-mailer. |
| zxcvbn |
Open source password strength estimator. Python port of Dropbox’s zxcvbn. Used in the portal API to enforce password complexity at signup. |
| pyairtable |
Open source Python client for the Airtable API. Used by klai-connector to ingest content when a customer connects an Airtable base as a knowledge source. |
| atlassian-python-api |
Open source Python client for Atlassian APIs. Used by klai-connector to ingest content from Confluence and Jira when connected as a knowledge source. |
| email-validator |
Open source email syntax and DNS validator. Used by klai-mailer before queueing transactional mail. |
| authheaders |
Open source DKIM, DMARC, and SPF email authentication library. Used by klai-mailer to sign and verify outbound mail. |
| publicsuffix2 |
Open source public-suffix-list lookup. Used by klai-mailer to compute eTLD+1 boundaries when scoping rate limits. |