Security
Built secure. Proven secure.
Security is built into every layer of Kanonika — how data is encrypted, how every action is authorized and signed, and how each change is verified and recorded.
Data protection
- Encryption at rest — AES-256 via AWS KMS, with separate customer-managed keys per service and automatic key rotation.
- Encryption in transit — TLS 1.3 on a mutually-authenticated control channel, verified against our private certificate authority.
- Customer data is tenant-isolated; we don't sell it or use it to train shared models.
Tamper-proof evidence
- Every detection, decision, and change is written to a hash-chained, tamper-evident ledger.
- The ledger is anchored in Amazon S3 Object Lock (WORM) with 7-year retention.
- Point-in-time evidence exports — auditors get a verifiable record, not a screenshot scramble.
Processing integrity
- Every remediation job is cryptographically signed (KMS ECDSA P-256) and verified by the executing agent before it runs.
- Non-destructive execution constraints with reversibility classification — risky changes require explicit acknowledgement.
- Closed-loop verification: an authoritative re-scan confirms each fix (patent-pending).
Access & isolation
- Portal-validated, tenant-scoped access tokens — no “any token” acceptance.
- Role-based access control across operator, approver, analyst, and viewer roles.
- Every data query is scoped to the tenant as its first condition.
Operational security
- VPC flow logging for network-level audit and forensics.
- KMS-encrypted log storage with retention controls; secrets are redacted from logs.
- Backups and recoverability — DynamoDB point-in-time recovery and S3 versioning.
Compliance posture
- Built to the SOC 2 Trust Services Criteria, with a TSC-mapped internal control program.
- 576 control mappings across CIS Controls v8.1, NIST 800-53 Rev 5, ISO 27001:2022, and SOC 2.
- Continuous, framework-mapped evidence of control state over time.
For your reviewers
Need detail for your security review?
We share control documentation and evidence under NDA.
Ready to close the loop?
See Kanonika run against your own estate — detection through to proof.