Security and data
The information your review team needs.
Understand how your workspace is separated, where data is processed and how access and evidence are handled. Start with the overview, then inspect the technical controls.
Three distinct boundaries
Follow the information.
Select a boundary to inspect where your workspace operates and where assessment processing takes place.
Each client has its own deployment and database. Business context and the regulatory review process are configured for that workspace.
Controlled access
Workspace roles separate viewing, review and configuration. Sessions last 12 hours, with user roles rechecked against the database every 10 minutes.
Recorded changes
Material changes create audit events with the actor and before-and-after values. The application has no path to update or delete those events.
Exportable evidence
An item's evidence pack records the source, assessment and review history so your team can retain a readable record outside Kehai.
What is used for an AI assessment?
The assessment process uses source material and the business context configured in your workspace to draft relevant outcomes. That includes business-profile context sent for AI inference; EU storage does not mean all processing stays in the EU. The Privacy Policy describes the providers used to operate the service.
Privacy policyFor your technical review
Current controls, in detail.
Open a control to inspect how it works. Contact us to discuss your review requirements and the evidence needed for your workspace.
Strict transport and headers
Every response carries a Content-Security-Policy that locks styles to the site's own stylesheets and frames to allow-listed origins, plus X-Frame-Options DENY, nosniff, a strict Referrer-Policy and a locked-down Permissions-Policy. Strict-Transport-Security is served with a two-year max-age. One exception remains and it is named here rather than glossed. The script policy still allows inline scripts, because the framework injects its own bootstrap script into every page.
Short sessions with live role checks
Sign-in sessions are 12-hour JSON Web Tokens rather than month-long defaults, and a live session re-verifies its user's role against the database every 10 minutes - offboarding takes effect mid-session, not at expiry.
Password storage and login throttles
Passwords are stored only as bcrypt hashes. Sign-in is throttled per account and per IP address, and a locked account fails exactly like a wrong password, so the throttle is not an account-existence oracle.
Hashed API keys
An API key is shown once at creation and persisted only as a SHA-256 hash. A database read cannot recover a key.
Signed webhooks
Outbound webhooks are HMAC-SHA256 signed over a timestamped payload, so receivers can verify origin and reject replays.
Append-only audit trail
Material changes write an append-only audit event with actor and before/after values. The application has no code path that updates or deletes one.
Guarded source fetching
Every source fetch is validated end to end, so a crafted link cannot steer verification into infrastructure it should never reach.
Official-source verification
A source counts as official only when it is verifiably the authority's own. A look-alike domain does not pass, and the model can never approve its own sources.
Evidence provenance
Evidence packs include the captured source excerpt where available, the capture time and a content fingerprint for change detection. The fingerprint is not cryptographic proof of the source. Review history is shown separately.
EU data at rest, disclosed AI processing
Data at rest stays in the European Union (Vercel and Neon). AI inference runs in the United States under Anthropic's data processing agreement and the 2021 EU Standard Contractual Clauses.
Procurement and assurance
Bring your requirements.
The current application uses administrator-managed email and password sign-in; it does not provide SSO or multi-factor authentication. Kehai makes no claim of SOC 2 or ISO 27001 certification. Standard retention periods for enquiries, terminated workspaces and backups are not yet defined. Contact us to inspect the current controls and resolve these requirements before relying on a particular assurance.