Security

Data Storage & Encryption

• Customer data is stored in a managed PostgreSQL database, encrypted at rest with AES-256 and in transit with TLS 1.2 or higher
• Tenant isolation is enforced at the database layer through row-level security rather than in application code, so each account can only reach its own data
• OAuth credentials are stored encrypted and are never exposed to client-side code or written to logs
• Generated assets, such as rendered tables and cached content, are held in private cloud object storage and served through the application
• User credentials are managed by our authentication provider using bcrypt hashing

Ephemeral Content Architecture

Kowiki uses an ephemeral, cache-based architecture rather than permanent content storage. This means:

• Content synced from external sources is held in a short-lived cache with a default TTL of 4 hours, not stored permanently
• Content is re-fetched from the source system when stale rather than kept indefinitely
• Expired cache entries are removed by a scheduled cleanup job
• Administrators can adjust the cache TTL to suit their account

This approach minimizes data exposure and ensures that customer content doesn't persist indefinitely in our systems.

Authentication & Access Control

• OAuth 2.0 integration with all connected platforms
• Row-Level Security (RLS) enforces tenant isolation at database level
• JWT-based session management

Data Retention

• Customer content is retained while the account and its content integration remain active
• AI assistant conversation threads and their messages expire after 30 days and are then deleted by a scheduled job
• Analytics are retained for up to 2 years, and payment records for 7 years to meet accounting obligations
• OAuth tokens are held only while an integration is connected

Data Removal

• Customers manage content in the source system, and anything removed there is removed from Kowiki on the next sync
• Disconnecting an integration revokes the OAuth token and deletes the content and cached data associated with it
• Deleting an account removes all data associated with that account
• Deletion requests can also be sent to privacy@kowiki.com and are processed within 30 days; copies may persist in encrypted backups for up to 90 days
• Kowiki does not archive customer content for its own purposes

Third-Party Security

• All third-party APIs use OAuth 2.0 or API keys with minimal scope
• OAuth tokens encrypted at rest
• Regular security audits of integration permissions

AI Transparency

• The AI Knowledge Agent runs on a managed AI service within Kowiki's own cloud project, pinned to a single United States region and not routed to other regions. The provider is listed in our subprocessors below
• Customer content is sent to that service solely to answer that customer's query, within their own account context. It is never shared with another Kowiki customer or with any other model provider
• Neither Kowiki nor our AI provider uses customer content to train models
• Answers can be inaccurate or incomplete, as with any AI system. Every answer cites the source document it drew from so it can be checked
• An MCP server is available for customers who want to connect their own AI agents

Incident Response

• Automated monitoring and alerting
• Incident response procedures documented
• Security vulnerabilities can be reported via security@kowiki.com — see Vulnerability Disclosure below

Vulnerability Disclosure

We welcome reports from security researchers and treat them as a core part of how we keep Kowiki safe. Send reports to security@kowiki.com. Include the affected component, the steps needed to reproduce the issue, and what an attacker could achieve with it. If a report contains sensitive detail, say so and we will arrange an encrypted channel before you send it.

This is a coordinated disclosure program, not a paid bug bounty. We do not offer monetary rewards, but we will credit reporters who ask to be named once an issue is resolved.

What is in scope

Every product surface we operate is in scope, including all of our platform apps:

• The Kowiki web application and API at kowiki.com
• The Kowiki Slack app — its bot user, slash commands, App Home surface, event subscriptions, and OAuth installation flow
• The Kowiki Microsoft Teams app
• Customer-facing wiki sites, including custom domains
• Our MCP server and the OAuth flows for every content source integration
• The authentication, tenant isolation, and billing systems

What is out of scope

• The infrastructure of our subprocessors, listed below. Report those to the provider directly
• Vulnerabilities in a customer's own connected systems, such as their Google Workspace or SharePoint tenant
• Denial of service, volumetric or load testing, and physical attacks
• Social engineering of our team, our customers, or our providers
• Scanner output with no demonstrated impact, and missing hardening headers or best practices with no working exploit path

Safe harbor

We will not pursue legal action against you, or ask others to, for security research conducted in good faith under this policy. To stay within it:

• Test only against accounts and workspaces you own or have permission to use. Never access, modify, or retain another customer's data
• Stop as soon as you have confirmed a vulnerability. If you reach customer data by accident, stop, do not save it, and tell us in your report
• Do not degrade our service or the service of a Slack or Teams workspace you are testing against
• Give us time to fix the issue before disclosing it publicly. Ninety days is our default, and we are happy to agree on something different when a fix needs longer

If you are unsure whether a specific test is permitted, ask us first at security@kowiki.com.

How we respond

• We acknowledge every report within 5 business days
• We complete triage and tell you whether we have validated the issue, along with its severity, within 10 business days
• We keep you updated as we work, and confirm when a fix has shipped
• Our remediation targets from the point of validation are 7 days for critical, 30 days for high, and 90 days for medium severity issues. Lower severity issues are addressed on our regular roadmap
• Where an issue affected customer data, we notify affected customers in line with our incident response procedures and applicable law

Subprocessors

We use the following subprocessors to deliver our service. Each has been vetted for security and compliance.

For questions about our security practices or to report a vulnerability, please contact security@kowiki.com.