Your data and privacy¶
What Kanonik holds and how it protects your record. It deliberately holds none of your source-system credentials.
Before a buyer connects anything to Kanonik, they usually run a security review. This page answers the questions that review asks about what Kanonik holds and how it is protected. It also covers what Kanonik deliberately does not hold. It is written to be read by your security team, so it is precise about what is a finished property and what is a design commitment.
What Kanonik stores¶
Kanonik holds your compliance record. That is your assets, vendors, risks, controls, policies, procedures, mappings, and the decisions made about them, together with the full history of how each one changed over time. This record lives in your own workspace. Every workspace's records carry a workspace id; row-level security in the database is forced on the core record tables, and the application checks the workspace on every request.
The record is the product. Kanonik does not copy your source systems and does not try to. It is the structured, reviewable account of your compliance posture and the decisions behind it.
What Kanonik does not hold¶
Kanonik does not hold the credentials to your source systems. Your cloud accounts, your code repositories, your ticketing system, and the rest of your estate stay connected to your AI, not to us. When your AI needs to read from one of those systems, it does so through its own tools, with credentials you control. Those credentials are never sent to Kanonik and are never stored by us.
This is a design choice. By never receiving your source-system credentials, Kanonik removes itself as a place where that access could be stolen or misused. There is no Kanonik-owned connector holding standing keys to your infrastructure.
Your AI provider¶
You bring your own AI. For example, you might connect Claude or another compatible assistant. Your conversation with that assistant is between you and your AI provider, under your agreement with them. Kanonik does not sit in the middle of that conversation and does not receive it.
What Kanonik sees is the specific tool calls your AI makes against your record: the policy it proposes, the mapping it suggests, the change it asks you to approve. It does not see your wider discussion with your AI. The boundary is deliberate and narrow: Kanonik governs the writes to your record, not your dialogue.
A record that cannot be quietly rewritten¶
Every change to your record is appended to a permanent, tamper-evident history. Each entry is linked to the one before it, so if any earlier entry were altered or removed, the break would be detectable. The history is append-only: entries are added, never edited in place and never silently deleted.
The database rejects edits and deletes of these entries, and any change made around that protection would break the signed hash chain and show up when the export is verified. The point is that anyone reviewing the record, including an outside auditor, can confirm that the history they are reading is the history that actually happened.
A person's account approves every change your AI drafts¶
Nothing your AI drafts reaches your compliance record on the strength of an AI suggestion alone. Each proposed change runs through a server-side safety check and then waits for an approval from a signed-in person's account, with a click on the approval link or in the dashboard. That approval is recorded as part of the entry, against that person, so the record shows what changed and why, along with whose account authorized it and when. Kanonik cannot tell whether the person, or software acting in their signed-in browser, made the click. A few things are saved without an approval; they are listed here.
Where your data is hosted¶
GDPR is included. Kanonik runs in one Oracle Cloud region, US East (Ashburn), for all customers, and web traffic passes through Cloudflare's global network. If you need your data held in another region, talk to us.
Encryption¶
Every connection from the internet uses TLS 1.2 or 1.3. Your data is encrypted at rest by our cloud provider (Oracle Cloud block storage, AES-256). Each workspace also has its own key in our key vault. Today it protects the workspace owner's email address and the addresses approval notices go to. The rest of your record is protected by database row-level security that keeps each workspace's records apart, and the network boundary between our services.
You can export the full history¶
You can produce an auditor-ready export of your complete decision history at any time before your subscription ends. The export includes the proposals, the safety-check verdicts, the reasoning, the approvals, and the integrity proof for the tamper-evident history, so a reviewer can verify that the record has not been altered. This is built so that the account you give an auditor is the same account the system can prove.
Frameworks¶
Kanonik supports 17 frameworks you can work in, including SOC 2, ISO/IEC 27001, HIPAA, GDPR and NIST CSF 2.0. Where a question from your review is not answered here, ask us directly at [email protected] and we will answer plainly.
More help¶
Browse every article in the Help center. For anything else, email [email protected] and a person who works on the product answers.