KnowBe4 Integration - Data Transparency | Notion

Overview

This document provides full transparency on how Assurix collects data from KnowBe4 during integration sync.

Key facts:

Assurix calls 5 KnowBe4 Reporting API endpoints for account, user, training, and phishing data
All requests are read-only (GET requests) using a separate Reporting API token (not the User Event API)
Only aggregated metrics are stored — no raw user data or PII is persisted
Credentials are stored in Azure Key Vault
All endpoints use cursor-based pagination (up to 500 records per page)

API Endpoints Called

Endpoint	Method	Purpose
`GET /v1/account`	GET	Account info (name, risk score, seat count) and connectivity test
`GET /v1/users`	GET	Active user count (individual user data is discarded)
`GET /v1/training/campaigns`	GET	Campaign list to identify active (non-Completed, non-Cancelled) campaigns
`GET /v1/training/enrollments`	GET	Enrollment statuses to calculate completion and past-due metrics
`GET /v1/phishing/security_tests`	GET	Phishing test results for phish-prone % and active campaign count

All endpoints use cursor-based pagination (up to 500 records per page).

What We Do NOT Collect

Individual user personal data (names, emails, phone numbers, job titles)
Training module content or course materials
Phishing email templates or landing pages
Individual click/open/action data
Group definitions or membership
KnowBe4 store purchases