Controls you can inspect.
Boundaries you should verify.
Kyndex includes access scoping, approval workflows and audit records. Their effectiveness depends on application configuration, connected services and the infrastructure you operate.
Identity and access
Authenticated requests carry user context. Knowledge and capabilities can be scoped to departments, with role-based administration. Provider configuration and correctly assigned permissions remain essential; this is not a claim that access-control defects are impossible.
Governed actions
Write actions enter a pending approval workflow before execution. Permitted read tools may run without approval. Administrators must classify tools accurately and restrict their downstream credentials.
PII handling
Presidio-backed detection and configurable privacy profiles support handling of detected entities in retrieval flows. Coverage depends on the path, language, entity recognisers and policy. Parsing, embedding, tool output and provider processing need their own review.
Stored secrets
Designated sensitive database fields use Fernet encryption with FIELD_ENCRYPTION_KEY. This is field-level protection, not encryption of every document, log or database volume. Operators must manage keys, backups and infrastructure encryption separately.
Audit records
Recorded activity can be inspected and exported. Audit entries include per-entry SHA-256 hashes over selected fields. These are not keyed signatures or a chained ledger, and do not protect against an administrator rewriting records and recomputing hashes.
Transport and infrastructure
Production console authentication uses Secure, httpOnly cookies and requires HTTPS. Operators are responsible for TLS termination, internal connections, database access, network policy enforcement, key rotation, backups and monitoring. Helm settings alone do not establish these controls.
External processing
Configured providers may receive document content, embeddings, prompts, identity information or tool payloads. Self-hosting Kyndex does not automatically keep that processing inside your network. Review providers, regions, contracts and retention before sending sensitive data.
Software checks
The repository includes automated tests, static checks and dependency/container scanning workflows. These reduce risk; they do not prove that a release is vulnerability-free or that every running deployment uses the latest fixes.
No implied certification or service level
This page describes implementation and deployment considerations, not a certification, compliance determination, penetration-test attestation or incident-response SLA. Any support or contractual commitments must be agreed separately.
Report a concern privately
Contact security@kyndex.io. Include affected versions, impact and reproduction steps. Do not send credentials or customer data.