Our encryption, access control, and information security standards
Last Updated:September 12, 2026v2.3
1. Overview
Kynic Agent considers protecting the confidentiality, integrity, and availability of our customers’ data and their End Users’ data to be its highest priority. Our platform is designed in accordance with Defense in Depth and Zero Trust security principles.
2. Infrastructure and Server Location
Server and Hosting Infrastructure: The Kynic Agent core application, relational and vector databases, chat histories, Customer Data, and account information are hosted and stored on virtual private server (VPS) infrastructure leased from a hosting provider located in Türkiye and managed by Kynic Agent, within data centers in Türkiye.
Data Center Standards: The data centers hosting our servers comply with international security standards including ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, and SOC 2.
3. Data Encryption
Encryption in Transit: Data traffic transmitted through our website, management dashboard, and all API endpoints is end-to-end encrypted using TLS 1.3 and HTTPS protocols.
Encryption at Rest: Customer Data, file contents, and technical records stored in our databases and object storage systems are protected using the AES-256 encryption standard. Sensitive integration credentials are stored using managed encryption mechanisms.
4. Tenant Isolation
Logical Segregation: Data isolation is logical. Each customer’s data and search records are completely isolated from one another at the database level through unique tenant identifiers (Tenant ID) and authorization controls. A customer’s access to another customer’s data or documents is technically prevented.
5. Authentication and Access Control
Session Security: User accounts are protected through a secure token (JWT) architecture. Passwords are never stored in plain text on our servers; they are securely hashed using strong salting and bcrypt / Argon2 algorithms.
Authorized Access: Access to production environments and customer data is restricted exclusively to authorized personnel and is subject to the "Need-to-Know / Least Privilege" principles.
6. Data Masking and Artificial Intelligence Security
Automated PII Masking: Before requests are sent to external artificial intelligence services (OpenAI, Anthropic, Google Gemini), Personally Identifiable Information (PII - First Name, Last Name, Phone Number, Email, Turkish National ID Number, etc.) contained in messages is scanned by our automated data masking layer and masked with neutral labels. Only masked text is transmitted to external systems.
Prohibition of Model Training: Submitted prompts are processed statelessly solely for the purpose of generating an immediate response. Customer Data or End User messages are never used to train general-purpose artificial intelligence models.
AI Security Firewall: Our AI assistants are protected against Prompt Injection and Jailbreak attempts through dedicated security layers.
7. Network and System Security
Our infrastructure is protected against distributed denial-of-service (DDoS) attacks and OWASP Top 10 security risks through an Enterprise WAF.
Dynamic rate limiting is applied to API endpoints and account login processes to prevent malicious automation and brute-force attempts.
In the event of a potential data breach, Kynic Agent undertakes to notify Customers by email without delay and within no later than 24–48 hours following detection.
8. Subprocessors
You can access the current list of subprocessors used for infrastructure, web hosting, and real-time artificial intelligence processing, together with their service purposes, on our Subprocessors page.
9. Vulnerability Reporting and Contact
If you believe that you have identified a security vulnerability in our platform, please report it directly through our security channel: