Security overview
This section describes what Kumkuat does with data as the product actually works today: which systems exist, where they run, what third parties touch, and where people stay in control. It is written to be attached to a security review as is.
Architecture
| Component | Where | Notes |
|---|---|---|
| Web application, REST API, background workers | Google Cloud Run, us-central1 | TLS on every connection; the web app calls the API; the API queues long work to the workers |
| Workspace data (documents, personas, reactions, chats, reports, embeddings, usage audit) | Google Cloud SQL for PostgreSQL, us-central1 | Encrypted at rest; private IP inside the platform's network; every row is keyed to a workspace |
| Uploaded files and press-release text copies | Google Cloud Storage, US multi-region | Private objects read through an authenticated proxy |
| Kumkuat's provider keys and connector tokens | Google Secret Manager | Injected into the running service; never in code or images |
| Workspace-supplied provider keys (bring your own key) | Workspace settings in Cloud SQL | Used only for that workspace's calls; masked in the app and API after saving; never logged |
| Sign-in | Firebase Authentication | Email and password; roles owner, admin, member, viewer |
Principles
- Workspace isolation. Every customer workspace is logically isolated; API keys are scoped to a single workspace.
- Read-only retrieval. Public content is retrieved outbound only. No Kumkuat feature posts to a social network, press wire or any external system on your behalf.
- Outputs stay on the platform. Reactions, chats, reports and drafts are shown to your users and saved to your workspace. They leave only when a user exports them or creates a share link, which the user can revoke.
- No training. Model providers are used on API tiers that do not train on content. Kumkuat trains no models of its own.
- People in control. Configuration is set by your admins; every generated output is reviewed by the requesting person before downstream use. See Human oversight.
What is not in place today
To keep questionnaires honest, the following are not offered at the moment: SAML or Google single sign-on; customer-supplied model keys used for inference; a zero-data-retention addendum with model providers. Ask your Kumkuat contact for the current status of third-party attestations and of these items.
Data flow
What is retrieved, from where, where it lands, and what a model receives.
Human oversight
In, on and over the loop, touchpoint by touchpoint.
Model provider controls
How a provider is deselected and how that is evidenced.
Data handling FAQ
Retention, deletion, sub-processors and the questions reviewers ask.