Security overview
Infrastructure
KIT ENGINE runs on managed cloud infrastructure in the EU and US regions, isolated per environment. Deliverables and uploads sit in encrypted object storage with per-workspace prefixes; databases are encrypted, backed up daily and restore-tested quarterly.
Access
Staff have no standing access to production data. Support access is requested, time-boxed, scoped to a workspace, logged, and visible to workspace owners on request. Provider credentials are held in a managed secret store and rotated on schedule and on staff change.
Identity
SSO through SAML or OIDC, optional SCIM provisioning, and enforced MFA where SSO is not in use. Roles are owner, admin, member and commenter, and spend authority follows the role rather than a separate setting.
Monitoring
Application and infrastructure logs are centralised with alerting on authentication anomalies, spend anomalies and provider error rates. Refusals and policy events are logged separately and retained for 24 months.
Incidents
We notify affected workspace owners within 72 hours of confirming an incident, with what was affected, what we know, and what we are doing. A written post-incident report follows within 14 days. We do not wait for certainty before telling you something happened.
Assurance
Annual third-party penetration test with the summary letter available under NDA. SOC 2 Type II is in progress; we will not claim it before the report exists.