Trust Center

This page describes how we secure cyankiwi and the data in it.

Security

In transit. All traffic to api.cyan.kiwi and the site uses TLS, and traffic from our systems to our suppliers is encrypted.

At rest. Stored data is encrypted.

Credentials. API keys are stored only as hashes; the plaintext key is shown to you once at creation and we cannot recover it. We hold no passwords. Service credentials are kept in a managed secret store.

Access. Our services run with least-privilege identities. Access to production systems is limited to those who need it, and everyone with it is bound by confidentiality.

Backups. The customer database is backed up automatically, and backups are kept for 7 days.

Data handling

Prompts and responses from the shared inference API and your Deployments are not stored. Workspace agent conversations are kept until you delete them or close your account. The Privacy Notice lists what we hold and for how long, and the sub-processor register lists who processes data for us and where.

Reporting a vulnerability

Email security@cyan.kiwi. We read reports and act on what we find.

We welcome research done in good faith and within these rules. We cannot waive criminal liability under the Computer Misuse Act 1990, and we cannot give permission on behalf of our suppliers.

Rules of engagement: no denial of service or load testing, no accessing or modifying another customer’s data, no social engineering of anyone, and please give us reasonable time to fix an issue before publishing.

Incidents

If a security incident affects customer data, we investigate, contain it, and notify affected customers without undue delay, as the Data Processing Addendum requires.