Here’s what Kanonik does with your data.
Perhaps your company is about to buy Kanonik, and you’ve been asked to review it. This page is for you. It describes Kanonik as it runs in production, because we expect you to check it.
The full terms are in our Privacy Policy and our Data Processing Addendum. The technical walkthrough follows one draft through every step and names each signing algorithm on the way.
Kanonik never holds keys to your systems.
Someone on your team connects your AI assistant to Kanonik and gives the assistant read access to the systems it should look at, such as your cloud account or your code repositories. The assistant reads them with that access and drafts records for your compliance program. Then it sends Kanonik those drafts, along with whatever you ask it to look up or answer from your record, such as a buyer’s questionnaire. We save every call it makes, and our response, in your record.
The AI provider stays yours. Its model runs on your account and under your contract, and Kanonik never calls it or sees your keys.
What we do keep is your compliance record and your account. The record holds your policies, controls, risks, vendors and evidence records, the questionnaire answers you’ve approved, who approved each one, and what our checks found. Some of it is personal data, such as the names of control owners and approvers. We’re your processor for that data, and we use it only to run the service. Your account holds details such as your name and work email. Card numbers go from your browser straight to Stripe and never reach a Kanonik server.
Kanonik’s checks send some of your drafts to Anthropic.
Before anyone on your team sees a draft, Kanonik checks it. The first check follows fixed rules on our own servers, and for some kinds of record that’s the whole check. Where a draft needs judgment, such as whether a control really meets a requirement, a second check asks a model. That model runs on Kanonik’s own Anthropic account, which we pay for. It’s a separate account from the AI you bring, even if your own assistant is Claude.
Anthropic receives the draft and the parts of your record needed to judge it. That can include personal data, such as a policy owner’s name. Anthropic’s commercial terms don’t allow it to train on that content, and we don’t train any model on your data ourselves.
We keep the check’s verdict, with its reasons and any excerpts from your record it relied on, because it’s part of your record and your auditor will want to see it. As for what we sent, we don’t keep a separate copy of it anywhere except our operational logs. We hold those for up to 90 days, on infrastructure we run ourselves.
This check is the only time Kanonik sends your content to an AI model outside our own servers.
We store your record encrypted, in Oracle Cloud in the United States.
Every workspace runs in one Oracle Cloud region, US East (Ashburn), and web traffic reaches us through Cloudflare’s network. If your record has to stay in another country, or inside your own network, talk to us about Enterprise. We’ll go through the platform with your team and test a private deployment in your cloud account or data center with you.
Encryption at rest
Oracle Cloud encrypts the disks and the object storage your data sits on, with AES-256 and keys Oracle manages.
A key for each workspace
Each workspace also has its own key in our key vault. It encrypts the workspace owner’s email, the addresses approval requests go to, and the proof-of-purchase number you enter when you license a copyrighted standard. The key never leaves the vault. Our services ask the vault to encrypt and decrypt.
In transit
Every connection from the internet uses TLS 1.2 or 1.3. Inside our cluster, our application services talk to each other over mutual TLS. Their calls to our key vault and our sign-in service, which we run in the same cluster, stay on the private network behind network policies and aren’t encrypted yet. We’re moving those calls to TLS.
Separation between workspaces
Every workspace’s records carry its workspace ID, and the application checks the workspace on every request. On the core record tables (events, entities and workspace settings), Postgres also forces row-level security, so it applies even to the tables’ owner. On some of the approval workflow’s tables, the application’s check is the only one.
Signing keys
The token behind each approval link is signed with ECDSA P-256, and the head of each audit chain with ECDSA P-384. Both signatures are made inside our key vault. The private keys stay there.
Cryptography
Our Go services run Go’s FIPS 140-3 cryptographic module, in FIPS mode.
Sign-in
Everyone who uses your workspace signs in as themselves. When someone asks Kanonik a question through their AI, they sign in to Kanonik too, and see only what their role allows.
Approvals work the same way. An approval link only works for someone signed in to your workspace. It expires within an hour and can’t be reused. Asking in the chat never counts as an approval, so every change to a compliance record traces back to a named person.
On Audit-Ready and Enterprise, your auditor can have a read-only seat for the engagement. To invite one, you give an end date and a reason, and the seat is removed once that date passes.
Export
You can export your record whenever you like, and check the export the way your auditor would. If your subscription ends, your workspace becomes read-only. You can still read your record and export it, and nothing in it changes.
Nobody can change your audit log without the change showing.
Every change to your record is saved as an event, with a hash of the event before it. So all of a workspace’s events form one chain. On a schedule, we sign the head of that chain. The database also rejects any edit or delete of an audit entry.
Suppose someone got past that and changed or deleted an entry anyway. The signed chain would break, and the break would show when anyone checks an export.
We also log every action that touches your record, with who did it and what happened.
Anyone you give a Sealed Audit Package to can check all of this themselves.
We build Kanonik to NIST SP 800-53, the control set FedRAMP is built on.
We made that choice at the first commit. We think security that a company adds later, one questionnaire at a time, covers the questions on the questionnaire and not much else.
Most of what building to 800-53 means is already on this page, and our post on how we built Kanonik goes through each part.
The rest is how our own code reaches production. First, the pipeline scans each change for known vulnerabilities. A high or critical finding that already has a fix stops the change right there. If it passes, the container image it builds is signed, and the build produces a software bill of materials listing our services’ dependencies. Our Go services run from minimal distroless images, as a non-root user. And the infrastructure under them is code too, deployed through a GitOps pipeline.
If you find a security problem in Kanonik, write to [email protected], the address in our security.txt file.
- Scanned
- Known vulnerabilities; a fixable high or critical finding stops it
- Signed
- The container image it builds
- Listed
- A software bill of materials per build
- Run
- Minimal distroless images, as a non-root user
- Deployed
- Infrastructure as code, through GitOps
These companies process your data on our behalf.
Every one is listed in Annex III of our DPA. We’ll email you at least 30 days before we add or replace one, and you can object under the DPA.
| Company | What it does for us | What it receives | Where |
|---|---|---|---|
| Oracle Cloud Infrastructure | Hosts Kanonik: servers, database and storage | Everything in your workspace | United States, US East (Ashburn) |
| Cloudflare | Sits in front of our web addresses, ends TLS and filters attacks | Everything sent to and from our web addresses, which it decrypts and passes on, including IP addresses and headers. It stores none of your compliance content. | Global network |
| Anthropic | Runs the model behind the Verifier’s check | The draft being checked and the parts of your record needed to judge it, which can include names such as a policy owner’s. Not used for training. | United States |
| Stripe | Billing and card payments | Your billing contact and payment details. Your card number goes to Stripe from your browser. | United States |
| Postmark | Sends approval and account emails | The recipient’s address, the approval link and a short summary of the item (a title, a name, or text cut to about 120 characters), never the full record | United States |
| GitLab | Holds the feedback and support reports you file | Your message and any attachments you add, with your account email and workspace ID. Kanonik adds no compliance records to a report. | United States |
| Slack, only if you connect it | Tells a channel or a person that a request is waiting | The channel or person you choose, the name of the person with a request waiting and a short summary of the item. If you name someone by email, we send Slack that address so it can find them. The approval link isn’t posted. | United States |
| Plausible | Counts visits to our public pages and sign-up path, without cookies | Page address and referrer, and a few sign-up event labels: plan name, billing cadence and whether a charge occurred. Nothing from inside your workspace. | European Union (Germany) |
Your own AI provider isn’t on this list, because you chose it and the contract is yours. Kanonik never calls it. Our key vault and sign-in service are open-source software, OpenBao and Keycloak, and we run them ourselves inside our Oracle Cloud account, so neither is on the list.
Our DPA covers processing under GDPR Article 28 and includes the standard contractual clauses where a transfer needs them. It also commits us to telling you within 72 hours of learning about a personal data breach that affects your data. You can read it now, and we’ll countersign a copy for you.
Send us your security questionnaire.
Your company probably has its own vendor questionnaire. Send it to [email protected], and we’ll answer it ourselves, including the questions this page doesn’t cover. We reply within two working days.