Security

Every database query is scoped to a single tenant at the database layer via PostgreSQL Row-Level Security (RLS). There is no application code path that can accidentally serve another tenant's data. Each tenant's data is logically separated and individually audited.

• In transit — TLS 1.3 enforced on all endpoints. HTTP requests are redirected to HTTPS. HSTS is enabled with a 1-year max-age.
• At rest — AES-256 encryption via AWS managed keys (SSE-S3 and SSE-RDS). Key rotation is automatic via AWS KMS.
• Backups — encrypted with the same key policy as primary data.

• Passwordless magic-link authentication by default — no password database to breach.
• SSO via SAML 2.0 / OIDC available for qualifying enterprise workspaces.
• Session tokens are rotated on every auth-state change and invalidated on sign-out.
• Role-based access control (RBAC) is enforced at the API layer.
• Multi-factor authentication (MFA) is available and recommended for all admin users.

The platform runs on AWS App Runner (application), AWS RDS PostgreSQL 16 (database), and AWS S3 (object storage), all in us-east-1. Network access to the database is restricted to the application's security group — no database ports are publicly accessible. All infrastructure is defined as code and changes are reviewed before deployment.

• Principle of least privilege — engineers are granted minimum access needed to do their job.
• Production database access requires explicit time-limited approval and is logged.
• No standing SSH or direct DB access to production systems.
• All production access is via audited tooling with identity-based credentials.

• OWASP Top 10 mitigations are applied and reviewed on each significant release.
• Content Security Policy (CSP), X-Frame-Options, and other security headers are enforced on all responses.
• Dependency scanning runs on every pull request. Critical CVEs block deployment.
• Input validation and parameterised queries throughout the codebase — no raw SQL string construction.
• Rate limiting is applied on all authentication and sensitive endpoints.

Automated point-in-time RDS snapshots are taken hourly and retained for 30 days. Restore drills are performed quarterly. Recovery Time Objective (RTO): 4 hours. Recovery Point Objective (RPO): 1 hour for paid workspaces.

If you discover a security vulnerability, please report it to support@kriyos.co with the subject line "Security Disclosure". Include a description of the vulnerability, steps to reproduce, and your contact information. We will acknowledge within 24 hours and keep you informed. We ask that you do not publicly disclose until we have had reasonable time to remediate.

Our incident response process follows four phases: Detection → Containment → Remediation → Post-mortem. Affected workspace admins are notified by email within 72 hours of a confirmed breach. Post-mortems for significant incidents are shared with affected customers on request.