Security

Last updated: 26 July 2026

Security is central to how we build kanros. The command-line tool runs entirely on your own infrastructure and never phones home, which means your prompts, traces, and results stay on your machine unless you explicitly choose to use the hosted platform. This page describes the measures that protect the optional EU-hosted platform. It is an overview, not a warranty; specific commitments are set out in the Data Processing Addendum.

Encryption

All traffic to the hosted platform is encrypted in transit using TLS (HTTPS). Data at rest — including databases, object storage, and backups — is encrypted using strong, industry-standard algorithms. Secrets and credentials are stored using dedicated secret-management rather than in plaintext.

Tenant isolation

Each customer’s data is logically isolated. Access is scoped per tenant and enforced at the application and data layers so that one customer cannot reach another’s traces, telemetry, or memory content.

Access control, SSO and SCIM

Access to production systems follows least-privilege principles, is restricted to authorised personnel, and is protected by strong authentication. For customer accounts we support single sign-on (SSO) and SCIM-based user provisioning/de-provisioning on eligible plans, so your identity provider remains the source of truth for who has access.

Audit logging

Security-relevant events across the platform are logged to support monitoring, incident investigation, and accountability. Where offered, tenant-level audit logs give administrators visibility into access and changes within their own workspace.

Backups and resilience

We take regular encrypted backups of platform data and test restoration so that we can recover from failures. Backups are retained on a rotation cycle and deleted in the ordinary course as they age out.

Hardened deployment

The platform runs on EU-based infrastructure (see our Sub-processors) with a hardened configuration: network segmentation, restricted administrative access, automated patching of the underlying stack, and secure defaults. Distributed binaries ship with SHA-256 checksums so you can verify integrity before installing, as documented on the Download page.

Secure development

kanros is written in Rust, which eliminates broad classes of memory-safety vulnerabilities by design. We use dependency review, automated checks in CI, and code review before changes reach production.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, please report it privately by emailing security@kanros.dev rather than disclosing it publicly, and give us a reasonable opportunity to investigate and remediate before any disclosure. Please do not access or modify data that is not yours, and avoid privacy violations or service disruption while testing. Full details are in our published SECURITY.md.

Contact

Security reports: security@kanros.dev
CC Conceptualise GmbH, Kolonnenstraße 8, 10827 Berlin, Germany