SECURITY

Security built around your decisions.

Kioku is designed for a simple promise: capturing the context behind a decision should never make your data harder to protect. These controls describe the public posture of the product today.

LAST UPDATED - JUNE 23, 2026

Contact usTrust center

AT REST

AES-256

Encrypted storage for decisions and context

IN FLIGHT

TLS 1.3

Encrypted traffic in production

ISOLATION

RLS

Per-account row-level data isolation

CONTROLS

What protects your data

These controls cover the public app, authenticated surfaces, the database, and the AI providers that index your decisions and context for search.

Encryption everywhere

Decisions and linked context are encrypted at rest with AES-256 and transmitted over TLS 1.3. Sensitive flows are built around secure browser sessions and protected API boundaries.

Tenant isolation

Every decision and linked context item is scoped to your account through Supabase Row-Level Security, so one account can never read or write another account’s data.

Key separation

Public browser keys, server-only service keys, and AI provider keys are separated through environment configuration and never exposed to the client.

Authentication

Accounts are protected by Supabase Auth with secure sessions. Authorization is enforced at every route boundary before business logic runs.

Backups

The database is backed up on a regular schedule so customer data can be recovered in the event of a failure, while honoring deletion requests.

No model training

Your decisions and context are never sold or used to train foundation models. They exist only to power search and recall inside your workspace.

DEVELOPMENT

Secure development practices

Security is enforced in the implementation path rather than handled as a separate checklist at the end.
  • Validate every public API input before business logic runs.
  • Keep authentication and authorization checks at route boundaries.
  • Apply least-privilege access to service keys and infrastructure.
  • Avoid logging customer decisions, linked context, or provider secrets.
  • Run dependency, type, lint, and build checks before production changes ship.

COMPLIANCE

Where we are today

We are transparent about program stage. Enterprise-specific reviews can be handled through the contact path.

IN PROGRESS

SOC 2 Type II

Controls are being mapped and evidence is being collected. A completed audit report is not currently published.

EXPORT & DELETE

Data rights

Export your decisions or request full account deletion at any time from Settings.

ACCESS

Least privilege

Service keys and infrastructure access are scoped to the minimum needed to operate the Service.

CUSTOMERS

How to help keep your account secure

ACCOUNTS

Protect credentials

Use strong passwords, avoid shared accounts, and rotate keys if exposure is suspected.

DECISIONS

Capture the why

Record the context, reasoning, alternatives, and consequences so the decision still makes sense months later.

DISCLOSURE

Report issues quickly

Send security findings through the vulnerability disclosure page.