Security
Security built around your decisions.
Kioku keeps a simple promise: writing down why your team chose something should never make that reasoning harder to protect. These controls describe the product as it runs today.
Last updated · October 23, 2026
Transport
TLS
Encrypted traffic in production
Storage
RLS
Account-scoped database access
Training
No
Decisions are never used to train models
Controls
What protects your decisions
These controls cover the public site, the signed-in workspace, the database and the AI provider that structures notes and answers recall questions.
Decisions stay private
Decisions, reasoning and linked context are scoped to your account. Kioku never sells them and never uses them to train AI models.
Encryption
Stored data is encrypted at rest, and production traffic is served over TLS. Sessions run through secure browser cookies and protected API routes.
Scoped data access
Supabase Row Level Security returns only the rows that belong to the signed-in account, so one account can never read or change another account’s records.
Key separation
Public browser keys, server-only service keys and AI provider keys are kept apart through environment configuration and never reach the browser.
Input validation
The decision, context and search APIs validate every request body against a schema before it reaches the database.
Account control
Export everything as JSON, change your profile or delete your account and its data from Settings, whenever you like.
Development
Secure development practices
Security is part of how each change is built, not a checklist at the end.
- Validate every public API input before business logic runs.
- Check authentication and authorization at every route boundary.
- Give service keys and infrastructure the least access they need.
- Never log decisions, linked context or provider secrets.
- Keep the demo workspace on seeded sample data, apart from real accounts.
- Run type, lint, test and build checks before a change ships.
Customers
How to help keep your account secure
Accounts
Protect credentials
Use a strong, unique password, avoid shared accounts, and change your password if you think it has been exposed.
Content
Capture what you may keep
Paste threads, notes and discussions you are allowed to store, and leave secrets such as keys and passwords out of decision records.
Disclosure
Report issues quickly
Send security findings through the vulnerability disclosure policy.