Trust & Security

This is the starting point for a security or vendor review of Kumkuat. It covers which documents we can share, how the platform is controlled, who processes data on our behalf, how to reach us about a vulnerability, and what has changed recently. Every page in this section describes the platform as it works today, not as planned, and is written to be attached to a review as is.

Last reviewed: 12 October 2026 · Security contact: security@kumkuat.ai · Request documents

At a glance

• Hosting. Google Cloud, us-central1. All stored data is in the United States. See the Security overview.
• Encryption. TLS on every connection; AES-256 at rest with Google-managed keys.
• Identity. Email and password, or your own identity provider over SAML 2.0 with your MFA and conditional-access policies, enforceable per email domain.
• Isolation. Every workspace is logically isolated and every database row and API key is scoped to one workspace.
• Models. Google Gemini, OpenAI and Anthropic on API tiers that do not train on content. Kumkuat trains no models of its own, and a workspace can run on its own provider keys.
• Read-only. Public content is retrieved outbound only. No feature posts, publishes or sends anything outside the platform on your behalf.
• People in control. Every generated output is reviewed by the person who asked for it. See Human oversight.
• Privacy. The privacy policy and terms of service are public, and every new sign-up records agreement to both.
• Assurance. The infrastructure is Google Cloud, whose SOC 2 and ISO 27001 reports cover the services Kumkuat uses; see Google Cloud's compliance offerings and its Compliance Reports Manager.

Documents available on request

Kumkuat's security programme is set out in the documents below (version 1.0, October 2026). They are shared with customers and prospects on request, under your agreement or a mutual non-disclosure agreement. Request documents by name.

• Information Security Policy
• Incident Response Plan
• Disaster Recovery Plan
• Data Classification and Retention Policy
• Third-Party Risk Management Programme, including the vendor inventory
• AI Governance Framework
• Full open-source dependency list

Already public on this site: the architecture and data-flow diagrams, the sub-processor list, and a linkable answer per questionnaire topic. Customer security questionnaires are completed on request.

Controls

The Security & compliance FAQ answers one topic per section, in the order most questionnaires ask, and every section has a stable link. The Control map shows the same controls mapped, one tile per criterion, to the SOC 2 Trust Services Criteria and ISO/IEC 27001:2022 Annex A.

Area	Topics
Cybersecurity	Identity and access · Encryption · Network security · Logging and monitoring · Vulnerability management · Incident response · Hardware and installed software
Data and information management	Data classification · Data residency · Retention and deletion · Data ownership · Privacy regulations
Technology and platform	Hosting model · Technology stack · APIs and integrations · Scalability
Resilience and operations	Availability · Disaster recovery · Backup and restore · Support and escalation · Releases and patching
Risk and vendor management	Sub-processors · Software supply chain · Compliance attestations · Exit and data export
AI	Model training · Model updates · Safety and human oversight · Adversarial input · Model provider controls

Sub-processors

Google Cloud hosts the platform. Google Gemini, OpenAI and Anthropic provide model inference; Sapling AI checks writing quality; Bright Data and Firecrawl retrieve public content; Alpha Vantage and Financial Modeling Prep supply press releases and transcripts; Twilio SendGrid and Loops deliver email; Slack receives digests if your admin installs the app. What each one receives, and a dated log of changes, is on the Sub-processors page.

Report a vulnerability

Email security@kumkuat.ai. The same address is published in security.txt. Include the steps to reproduce and the affected URL or API route. Please do not access, change or keep data that is not yours, and do not run denial-of-service or social-engineering tests. Kumkuat does not run a paid bug-bounty programme.

Security updates

Security-relevant changes to the platform, newest first. Product changes are in the release notes.

• 9 October 2026. Published the privacy policy and terms of service; new sign-ups record agreement to both.
• 12 October 2026. Risk assessment extended with a fraud-risk analysis and performance measures; weekly triage of security advisories started; public access prevention enforced on the build and gallery storage buckets. Control map updated.
• 9 October 2026. Dependency vulnerability alerts and automatic security-update pull requests turned on for the source repository (GitHub Dependabot). Published the Control map.
• 5 October 2026. Email-and-password sign-in requires a minimum password length of eight characters for new accounts and new passwords.
• 5 October 2026. Published security.txt and the security@kumkuat.ai reporting address.
• 2 October 2026. Added Sapling AI to the sub-processor list.
• 21 September 2026. Single sign-on over SAML 2.0 became self-service for workspace admins, with enforcement per email domain. See Single sign-on.
• September 2026. The production database moved to Google Cloud SQL in us-central1, reached over a private VPC connection with TLS required. A full restore was carried out as part of the move.
• 11 September 2026. Bring your own key: a workspace can run its model calls on its own OpenAI, Google Gemini or Anthropic account. See Models and providers.
• August 2026. Stored files are destroyed 30 days after a document is deleted, and deleting a workspace purges its stored files.