Boring by design.

Data protection

• In transit: TLS 1.2 or higher for all traffic between your browser/app and Kairo, and between Kairo and our sub-processors. HSTS is enabled on heykairo.io.
• At rest: AES-256 for database content, file storage, and backups.
• Application-layer: Integration tokens and provider keys are encrypted with AES-256-GCM using a key derived via scrypt from TOKEN_ENCRYPTION_KEY. Never logged. Never returned to the client.

Access control

• Row-level security (RLS) on every workspace table. A query can only return rows the requesting user is authorized to see.
• Role-based permissions: owner, admin, member, viewer per workspace. Sensitive operations (delete workspace, change billing, modify roles) require admin or owner.
• Session tokens are time-bound, server-revocable, and refreshed silently.

Production access

• Least-privilege access for Kairo Labs personnel, granted only when responding to a customer ticket or incident.
• Production access is logged with timestamp, actor, action, and scope.
• Direct database access requires MFA and an approved ticket.

Application security

• Static analysis on every commit; dependency scanning runs on a schedule.
• Content Security Policy on the marketing site; strict CORS on the API.
• CSRF protections on every mutation endpoint.
• Rate limiting on authentication, capture, and Kairo AI endpoints.
• OWASP Top 10 checks in code review.

Incident response

• 24/7 paging for critical alerts — Sentry and uptime probes wake the on-call engineer directly.
• Post-incident review for every Sev1 and Sev2 with a written summary and follow-up actions.
• Personal-data breaches are reported to affected customers within 72 hours (see DPA §9).

Business continuity

• Continuous database backups; restore-tested on a regular cadence.
• Backups encrypted with separate keys.
• Backups retained for ≤ 90 days; purged on a fixed rotation after account deletion.

Sub-processors

Vendors who process data on Kairo's behalf are listed by category on the Sub-processors page. Each is bound by a data-protection agreement; AI inference providers are configured for zero data retention.

Compliance posture

• GDPR / UK GDPR: Kairo acts as Data Processor under a DPA on request.
• CCPA / CPRA: Kairo does not sell or share personal information. See Do Not Sell or Share.
• COPPA: Kairo is not directed to children under 13. See Children's Privacy.
• SOC 2 Type II: Not currently pursuing.

Reporting a vulnerability

Report any security issue to security@heykairo.io. We ask you to:

• Give us reasonable time to fix before public disclosure.
• Not access more data than needed to demonstrate the issue.
• Not run denial-of-service tests against production.
• Avoid testing against accounts that aren't yours unless we've explicitly authorized you.

Good-faith reports are appreciated. We do not pursue legal action for testing performed within these limits.

A PGP public key is available on request — email security@heykairo.io.