Your competitive strategy is the whole product
Kironyx knows who you watch and what you're told about them. Here's how that data is protected, in plain language, with the receipts linked.
What we store
- Account basics: email, name, plan tier
- Workspace data: competitor URLs, AI analysis, briefings
- Audit trails with 90-day in-app retention
What we never store
- Payment-card data (Paddle is the merchant of record)
- Health data, government IDs, or biometrics
- Dossiers on people: the research classifier blocks attempts to research individuals; we monitor companies
How it's protected
Serverless, single-region AWS
Fully serverless on AWS us-east-1 (Lambda, API Gateway, DynamoDB, Cognito) with no long-running servers to patch. Each workspace's data is logically isolated by tenant key at the data layer, so cross-tenant reads are impossible by construction.
Encryption in transit and at rest
TLS 1.2+ enforced end to end. DynamoDB and S3 encrypted at rest with AWS KMS. Secrets live in AWS Secrets Manager with quarterly rotation. Passwords are managed entirely by Amazon Cognito, so we never see plaintext. API keys are stored only as SHA-256 hashes.
Access control
Customer auth via Cognito with email verification and optional MFA. Workspace roles gate destructive actions to owners. On our side: hardware-MFA root account, per-function IAM roles with no wildcard policies, and quarterly access reviews.
Audit logging
A multi-region CloudTrail with file validation retains every AWS API event for 7 years in an object-locked bucket. In-app audit events record owner-level actions with actor, IP, and user agent.
Network protection
Deliberately tight API Gateway throttling, with the strictest limits on the auth endpoints, plus per-API-key quotas and durable rate-limiting on sign-in and email verification. Edge DDoS absorption via AWS Shield Standard; managed WAF rules are staged for public launch.
Incident response
A documented incident runbook with severity definitions and playbooks. Confirmed breaches affecting customer data are notified within 72 hours (GDPR Art. 33). Live system status is published at status.kironyx.com.
Compliance posture
Shipped today: GDPR data export, deletion, and restriction-of-processing; CCPA rights to know and delete; a 72-hour breach-notification commitment; and a public sub-processor list. A SOC 2 Type 1 readiness program is underway: we'll say audited when an auditor has said it, not before.
| Key sub-processor | Service | Certifications |
|---|---|---|
| Amazon Web Services | Hosting & infrastructure | SOC 2 Type II, ISO 27001 |
| Anthropic | Claude AI research | SOC 2 Type II |
| Paddle | Payments (merchant of record) | PCI DSS Level 1, SOC 2 Type II |
Full list with regions: sub-processor disclosure · privacy policy · DPA
Found a vulnerability? Our disclosure policy lives at /.well-known/security.txt. Or write directly to security@kironyx.com. Security questionnaires answered for prospective customers on request.