Built to be verified.

Every evidence record is hashed using SHA-256 at the point of generation. Each record's hash is incorporated into the next record, forming an append-only chain. Tampering with any record in the chain breaks every subsequent hash, making any modification immediately detectable.

Evidence is captured at the moment of the AI decision, not reconstructed after the fact. Timestamps are bound to the hash at capture, not at write time. This is what distinguishes evidence from a log.

Any record can be verified independently at kaironull.com/verify using its SHA-256 hash. No account required. Verification logic is documented at how-verification-works.

kaironull.com is served via Cloudflare Pages on a global edge network. TLS 1.3 enforced. HSTS with preload active. All traffic is encrypted in transit.

All responses include: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and a restrictive Content-Security-Policy. No third-party scripts are loaded outside approved origins.

We collect no third-party cookies, no device fingerprints, no cross-site identifiers. The only personal data we hold is newsletter subscriber email addresses. See our Privacy Policy.

All API calls to the Umbra Trust Protocol require a signed bearer token issued at onboarding. Tokens are scoped per integration, short-lived, and rotatable without service interruption. Leaked tokens can be revoked immediately from the customer portal.

Evidence records are write-once from the integration and read-controlled by role. Auditors can be granted read-only access to specific ledger ranges without access to other system functions. All access events are themselves logged in the audit trail.

KairoNull does not use shared API keys or symmetric secrets for customer authentication. Each integration receives a unique credential pair. Multi-tenant isolation is enforced at the data layer, not just the application layer.

Cloud-hosted deployments are designed for HSM-backed key stores using AWS KMS, so signing keys never exist in plaintext in application memory or storage, with automated key rotation on a defined schedule. This is on the deployment roadmap and not yet deployed.

The public key used to verify your evidence bundle is provided to you at onboarding and can be stored independently. This means you can verify the integrity of any record even if KairoNull ceases to operate, with no dependency on our infrastructure.

Third-party penetration testing is planned, and scheduling with an independent security firm is in progress. The scope will cover API endpoints, authentication flows, cryptographic record generation, and infrastructure configuration. Results will be used to drive remediation before enterprise contracts are signed.

KairoNull is on a structured path to SOC 2 Type II certification. Enterprise customers who require this as a procurement condition can discuss timeline in the scoping call. Interim security evidence is available under NDA.

Our internal security controls are mapped against the ISO 27001:2022 framework. Documented policies cover information security, access control, incident response, and data classification. Formal certification is roadmapped alongside SOC 2.

The evidence capture pipeline is designed for high availability. Cloud deployments use multi-region redundancy. Enterprise SLA terms are available to negotiate as part of Professional and Enterprise tier contracts.

We operate a documented incident response playbook covering detection, containment, notification, and post-incident review. Enterprise customers are notified within 1 hour of any incident affecting evidence capture availability or integrity. Status updates are published at kaironull.com/status.

Cloud deployments use EU-region infrastructure by default. US and APAC region options are available on request. The Sovereign tier provides full on-premise or private cloud deployment for organisations that require data to remain within their own environment. Data residency region is documented in your contract and reflected in your DPA.