Security

Data Storage & Encryption

• All data stored with encryption at rest and in transit (TLS 1.3)
• User credentials managed through industry-standard authentication providers with bcrypt hashing
• Customer content encrypted using AES-256

Ephemeral Content Architecture

Kowiki uses an ephemeral, cache-based architecture rather than permanent content storage. This means:

• All converted content lives in a cache with automatic expiration (TTL), not permanently stored
• Expired cached content is automatically deleted by scheduled cleanup jobs
• Content is refreshed on demand from source systems and expires when no longer needed
• Cache expiration times can be adjusted based on account needs

This approach minimizes data exposure and ensures that user content doesn't persist indefinitely in our systems.

Authentication & Access Control

• OAuth 2.0 integration with all connected platforms
• Row-Level Security (RLS) enforces tenant isolation at database level
• JWT-based session management

Data Governance

• Multi-tenant architecture with strict account isolation
• Clear separation of customer data by account
• Data retention aligned with subscription lifecycle

Third-Party Security

• All third-party APIs use OAuth 2.0 or API keys with minimal scope
• OAuth tokens encrypted at rest
• Regular security audits of integration permissions

AI/ML Transparency

• AI Knowledge Agent powered by Google Vertex AI
• User content used to answer queries within their account context
• No training on user content - data not used to train AI models
• MCP Server allows users to connect their own AI agents

Incident Response

• Automated monitoring and alerting
• Incident response procedures documented
• Security vulnerabilities can be reported via security@kowiki.com

Subprocessors

We use the following subprocessors to deliver our service. Each has been vetted for security and compliance.

For questions about our security practices or to report a vulnerability, please contact security@kowiki.com.