Most security is a promise. Ours is a shape.

00The shape

Almost every enterprise security questionnaire is written for one architecture: a multi-tenant cloud — many customers, one shared database, one engineering mistake away from a cross-customer leak. Most of the cloud incidents of the last decade come from that shape. KayOS isn't that shape, so most of the questionnaire stops applying. Three structural decisions do the work — everything further down is the detail behind them.

1No shared substrate

Every customer gets their own vessel — their own server, database, filesystem, and Kay process, running nothing but their account. There is no shared customer database and no horizontal pipe between accounts. We can't leak your data to another customer because there is no shared place to leak it from. The architecture is the property. → isolation, encryption & access

2Patterns, not data

Vessels do get better from one another — but what crosses the wire is anonymized structural patterns ("this kind of dashboard tends to work when this kind of data lands"), stripped of every particular, never raw data, and never promoted below a three-customer anonymity floor. We considered building a central model of customer state and deliberately chose not to. → the AI / data boundary

3The right to exit

Your vessel is yours. Full export of your data, files, and Kay's memory on request; we help you migrate; no technical or contractual lock-in. The exit door isn't a concession we make — it's load-bearing. A network you are free to leave is one that has to keep earning you. → portability & your rights

01Isolation — one customer per substrate

Concretely, what "your own vessel" means: a dedicated cloud server provisioned for your account alone, running nothing but your environment. Your application database, your filesystem, your logs, and Kay's working memory all live on that one machine. No row in any table belongs to another customer — there is no multi-tenant database for a mis-scoped query to cross.

This is why KayOS can sidestep whole classes of risk that multi-tenant AI vendors have to mitigate with controls and audits: there is no shared substrate from which a cross-customer leak could originate. The isolation isn't a setting we maintain — it's the default state of the system.

What vessels share is never raw data — it's patterns: anonymized structural lessons, distilled across many engagements and stripped of all particulars before crossing the wire. That boundary is detailed in §06.

02Data handling

Where your data lives

Your data lives on your vessel — a dedicated cloud server (currently DigitalOcean, region of your choice; see §05) provisioned for your account alone. Logs, application database, file storage, and Kay's working memory all live on that single server.

Data we collect

• What you put into your vessel — emails you connect, calendar events, files you upload, conversations with Kay, integration sources you authorize. This is operational data; we cannot do the work without it.
• Telemetry — anonymous interaction signals (counts, errors, friction patterns). No content. No identity. On by default; can be disabled in vessel settings.
• Our engagement record — our notes about working with you, the way any operator (consultancy, accountant, fractional executive) keeps an engagement file. Stays on our side; bound by fiduciary duty.

Retention

• Hot (active engagement) — full granularity, real-time, used for daily operating
• Warm (recent past, ~12 months) — daily summaries, weekly digests, key decisions retained for context
• Cold (>12 months) — pattern-level only; specific records pruned
• On request — customer-controlled deletion at any tier, at any time

Deletion & portability

If you choose to leave KayOS, your vessel is yours. You can take a full export of the database, your filesystem, and Kay's accumulated memory. We will help you migrate. There is no contractual or technical lock-in beyond the work you've built on top of the substrate — and that work is yours too.

Deletion requests are honored within 30 days for our engagement record. The vessel itself, being yours, is deleted on your timeline.

03Encryption

04Access control

Authentication

Magic-link only. We do not store passwords. Email-based sign-in produces a one-time, 15-minute-expiry token delivered through our transactional email provider (see §05). Sessions are httpOnly + secure cookies with 30-day TTL.

Authorization

Each vessel has an explicit allowlist of email addresses. Allowlists are managed per-vessel by the operator. No global directory; no cross-vessel identity.

KayOS team access

The KayOS team has SSH access to vessels for operational support, scoped through our Hermes protocol (see §07). Customers can revoke this access at any time. We make our access audit log available on request.

Federation between vessels

Two vessels can federate only by mutual key exchange — both sides hold an HMAC secret unique to that pairing. Federation is opt-in per-direction and revocable at any time. No vessel can pull from another without an active federation credential.

05Sub-processors

Vendors we use in operating your vessel. We will notify you at least 30 days before adding a new sub-processor to your engagement.

Current as of May 2026. Full and continuously updated list available at security@kayos.ai.

06Patterns, not data — the AI / LLM boundary

This is the section enterprise procurement asks about more than any other. Plain answers:

• Does my data train Anthropic's models? No. We operate Anthropic API with enterprise terms that opt out of training data usage.
• Does my data train any other model? No. We do not train our own models on customer data, and we do not share customer data with any other AI vendor.
• What does cross-vessel "network learning" actually share? Anonymized structural patterns only, with your contractual permission. Specific identifiers (people, companies, content, numbers) are stripped before promotion. Patterns observed in fewer than 3 customers are not promoted (statistical anonymity floor).
• Is my data sent to Anthropic with each conversation? Yes — conversation context (system prompt + your prompt) is sent to Anthropic's inference API to generate a response. It is not retained by Anthropic for training under our enterprise terms.
• Can I disable network-pattern contribution from my engagement? Yes, contractually and in the vessel settings.

07Audit & logging

What we log

• Hermes write log — every operational write to your vessel by the KayOS team is recorded with operator identity, timestamp, file path, diff preview, and outcome. The full log is available on request.
• Authentication log — sign-in attempts (successful + failed) with timestamp, email, IP.
• System logs — vessel-server process logs (errors, uptime, daemon runs) retained for ~30 days on the vessel.
• Kay action log — actions Kay takes on your behalf (artifact writes, integration calls) are recorded in the vessel's chat history.

Audit access

You can request any of these logs at any time. We will export them within 5 business days. For compliance-heavy engagements we can wire the logs into your SIEM (Splunk, Datadog, etc.) on request.

08Backups & disaster recovery

• Snapshots — automated DigitalOcean droplet snapshots on a 24-hour cadence for each vessel; retained 7 days minimum.
• Hermes backups — every operational write via Hermes is preceded by a remote backup of the prior state; these accumulate in .hermes-backups/ on the vessel.
• Application state — markdown content is the source of truth; SQLite is rebuildable from markdown. Rebuilds verified periodically.
• RTO — Vessel restoration from snapshot is typically <30 minutes; we have run live restorations under that target.
• RPO — <24 hours by default; sub-hour replication available for compliance-heavy engagements on request.

09Incident response

We are a small team. Our incident response posture is correspondingly direct: a real human responds, fast.

Commitments

• Initial response — within 4 hours of report, any time of day.
• Customer notification — within 24 hours of confirmed incident affecting your data.
• Containment + remediation — engaged immediately on confirmation; status updates every 4 hours until resolved.
• Post-mortem — written within 5 business days of resolution, shared with affected customers.

What to report

Email security@kayos.ai. Suspected breach, anomalous activity, vulnerability disclosure — anything that should reach us fast.

10Compliance posture

We're honest about where we are.

11Advanced controls

For customers with elevated compliance posture (financial advisory, healthcare-adjacent, legal), we layer additional controls into the vessel architecture. These are available on request and priced into the engagement.

12Your rights

• Audit — request what KayOS holds about your engagement, and what's been promoted to the network's pattern layer. We will provide it.
• Deletion — request deletion of your engagement record at any time. Honored within 30 days. Anonymized patterns already promoted to the network are non-identifiable; they remain (as the network's wisdom) but cannot be reconnected to you.
• Portability — full export of vessel data + configuration on request. No technical or contractual lock-in.
• Telemetry opt-out — anonymous Tier-1 telemetry can be disabled in vessel settings.
• Network-pattern opt-out — contributions to the network's pattern layer can be disabled in your contract.
• The right to ask — anything in this document, or anything we observe or hold, you can ask about. We will explain plainly. If we can't explain plainly, we shouldn't be doing it.

13Keeping the architecture honest

Architecture only means something if the team operating it internalizes it. Our internal commitments:

• Engineers do not cache intermediate analyses "just to debug" if the cache would constitute a meta-model.
• Product features are checked against the principles on this page before shipping.
• Contracts say what we do; what we do matches what the contracts say.
• When in doubt, the answer is less observation, less retention, less aggregation.
• We operate the way a high-trust consultancy operates, not the way a surveillance platform operates — fiduciary observation with AI augmentation, not AI vendor with privacy theater.

These commitments are how we keep the architecture honest over time. We expect to be held to them.

14Contact & vulnerability disclosure

Security questions, audit requests, sub-processor list, control maps:
security@kayos.ai

Vulnerability disclosure: we have not yet established a formal bug bounty program. Until we do, please email security@kayos.ai with details. We commit to acknowledging within 4 hours and working with you on responsible disclosure timing.

For commercial engagement, DPA, BAA, and contract templates:
david@kayos.ai