Security
Built secure. Proven secure.
Security is built into every layer of Kanonika — how data is encrypted, how every action is authorized and signed, and how each change is verified and recorded. Here are the controls in place today.
Data security
- Encryption at rest — AES-256 via AWS KMS, with separate customer-managed keys per service and automatic key rotation.
- Encryption in transit — TLS 1.3 on a mutually-authenticated control channel, verified against our private certificate authority.
- Customer data is tenant-isolated; we don't sell it or use it to train shared models.
Tamper-proof evidence
- Every detection, decision, and change is written to a hash-chained, tamper-evident ledger.
- The ledger is anchored in Amazon S3 Object Lock (WORM) with 7-year immutable retention.
- Point-in-time evidence exports — auditors get a verifiable record, not a screenshot scramble.
Processing integrity
- Every remediation job is cryptographically signed (KMS ECDSA P-256) and verified by the executing agent before it runs.
- Non-destructive execution constraints with reversibility classification — risky changes require explicit acknowledgement.
- Closed-loop verification: an authoritative re-scan confirms each fix (patent-pending).
Access & isolation
- Portal-validated, tenant-scoped access tokens — no “any token” acceptance.
- Role-based access control across operator, approver, analyst, and viewer roles.
- Every data query is scoped to the tenant as its first condition.
Operational security
- VPC flow logging for network-level audit and forensics.
- KMS-encrypted log storage with retention controls; secrets are redacted from logs.
- Backups and recoverability — DynamoDB point-in-time recovery and S3 versioning.
Compliance posture
- Built to the SOC 2 Trust Services Criteria, with a TSC-mapped internal control program.
- 576 control mappings across CIS Controls v8.1, NIST 800-53 Rev 5, ISO 27001:2022, and SOC 2.
- Continuous, framework-mapped evidence of control state over time.
Need detail for your security review?
We share control documentation and evidence under NDA.