Security built into every layer
EU data residency, TLS 1.2+ in transit, field-level encryption for sensitive tokens, an RFC 9116 disclosure policy, and an incident response committed in writing. Here is exactly what we do, who we share data with, and how to report a problem.
Concrete commitments, not platitudes
The four numbers that matter for a workspace admin evaluating us against an enterprise checklist.
How to report a finding
Coordinated disclosure, plain text, no NDAs to sign before reporting. Researchers acting in good faith are protected from legal action.
Acknowledge
Human reply from [email protected] confirming receipt & assigning a tracking ID.
Triage
Severity rated (CVSS-aligned), reproduction confirmed, internal ticket opened with disclosure deadline.
Remediate
Hard targets by severity: Critical <30d, High <60d, Medium <90d. Researcher kept in the loop.
Acknowledge
Written acknowledgement of the finding and, with the researcher's consent, a public thank-you in the release notes.
In scope Report these
- ks-agents.com and all subdomains (production, staging, marketing).
- The KS-Agents REST & GraphQL APIs.
- The KS-Agents Slack app — slash commands, Events API, OAuth flow, interactivity.
- The KS-Agents Microsoft Teams bot.
- All customer-facing dashboards, including embedded views.
Out of scope Don't bother
- Social engineering, phishing, physical attacks.
- Volumetric DoS / DDoS or rate-limit fuzzing.
- Missing best-practice headers without a demonstrable impact.
- Vulnerabilities in third-party services we use (report upstream).
- Unvalidated scanner output without a hand-crafted PoC.
Defence in depth, by layer
What we actually do — not what an aspirational marketing page says we do. Each line below maps to specific code, configuration, or contract.
Identity & access
Authentication options that match enterprise procurement requirements.
- Entra ID SSO (OIDC) for tenant-wide login
- Google OAuth & LinkedIn OAuth fallbacks
- SCIM 2.0 user provisioning
- MFA enforced on staff accounts
- Per-user capability grants in the Slack layer
Data protection
TLS in transit, field-level encryption for sensitive tokens, EU-resident storage.
- TLS 1.2+ for all traffic, HSTS preload
- Fernet (AES-128-CBC + HMAC-SHA256) for bot tokens & audit module rows
- Per-environment master key, rotated per environment
- Daily database snapshots, 7 most recent retained
- Cloudflare R2 EU jurisdiction for customer media
Integration hardening
Specifically for the Slack and Teams integrations.
- HMAC-SHA256 verification on every Slack webhook
- 5-minute timestamp tolerance (replay prevention)
- Event-ID deduplication via Redis (1-hour TTL)
- Cross-tenant isolation enforced at DB level
- Magic-login tokens: 2-min TTL, single-use, atomic consume
Who handles your data, and where
The minimum set required to run the platform. Standard Contractual Clauses signed with every non-EU vendor. Full list and DPAs at /legal/subprocessors/.
| Vendor | Purpose | Region |
|---|---|---|
| Hetzner | Application + database hosting | EU · Finland |
| Cloudflare R2 | Object storage (media, exports) | EU jurisdiction |
| OpenAI | LLM inference (text, embeddings) | EU endpoint where available |
| Google Cloud (Vertex AI) | LLM inference (voice, text) | europe-west4 (NL) |
| Microsoft Azure OpenAI | LLM inference (EU fallback) | Sweden Central |
| Requesty | LLM routing layer (ZDR) | Stateless proxy |
| Stripe | Billing & subscriptions | Global, SCC signed |
| Postmark / Resend | Transactional email | US, SCC signed |
| Iubenda | Privacy policy & consent management | EU |
Honest about what we do and don't have
We are transparent about which frameworks we actively implement and which are on the roadmap. No marketing claims we can't back up.
Actively followed In place
- GDPR — DPA available at /legal/dpa/, Art.17 erasure within 30 days.
- RFC 9116 — security.txt published & current.
- EU Data Privacy Framework — Schrems II compliant, SCCs signed where data leaves the EU.
- Internal continuous AI pentesting (Shannon tool).
On the roadmap Not yet
- Formal external penetration test.
- Encryption-at-rest for Postgres volume (LUKS) and database snapshots.
Found something? Tell us first.
Reports acting in good faith and within this policy are protected from legal action. Written acknowledgement to the researcher on every accepted finding.
[email protected]