Security at Kernel Service
Your AI agents access your most sensitive business systems. We take that responsibility seriously. Here's how we protect your data.
Infrastructure
AWS Hosting
Production infrastructure runs on AWS Sydney (ap-southeast-2). ECS Fargate serverless containers — no persistent servers to patch or maintain.
Encryption
TLS 1.3 for all data in transit. AES-256 encryption at rest for databases, secrets, and integration tokens. No exceptions.
Edge Protection
Cloudflare provides DDoS mitigation, web application firewall, and DNS. IP addresses are never stored in our analytics.
Isolated Environments
Separate infrastructure for production, staging, and development. All infrastructure is defined as code (Terraform) and reproducible.
Data isolation
Multi-tenancy is not an afterthought. It's the foundation.
Tenant Isolation
Every customer tenant is completely isolated. Separate data, encryption keys, connector credentials, and audit trails. An explicit tenant_id is enforced on every database query.
LLM Provider Isolation
No cross-tenant data is ever included in any LLM prompt. We access providers via commercial API tiers only — they do not train on your data.
Credential Isolation
OAuth tokens are encrypted per-tenant with scoped permissions. Agents can only access the integrations you have connected and authorised.
Application security
OWASP Top 10 controls embedded in development practices
Role-based access control with scoped permissions
Risk tiers for agent actions — low, medium, and high risk classifications
Complete audit trail — every agent action logged with reasoning trace, tool calls, cost, and latency
JWT authentication with short-lived tokens
Automated code linting and type checking in CI pipeline
Human-in-the-loop approval required for all high-risk agent actions
Compliance
Australian Privacy Principles
Privacy Act 1988 (Cth)
GDPR / UK-GDPR
Aligned data handling and user rights
Data export and erasure
GDPR endpoints for access and deletion requests
Consent-based analytics
Three-tier consent (none, analytics, full)
Notifiable Data Breach scheme
OAIC NDB compliance
We are not currently ISO 27001 certified. We believe in being transparent about what we have and what we're working toward. For full details on data handling, see our Privacy Policy.
Reporting vulnerabilities
If you discover a security vulnerability, we want to hear about it. We welcome responsible disclosure and will work with you to resolve any issues promptly.
Contact us at [email protected]. Please include a description of the vulnerability, steps to reproduce, and any supporting evidence.