Security Overview

Security is foundational to how KairosAI Technologies Private Limited, a company incorporated under the Companies Act, 2013 with its registered office at Flat No. E-506, Pristine Allure, S.No. 20/2A, Vadgaon Sheri, Pune City, Pune, 411014, Maharashtra, India (“KairosAI”, “we”, “us”, “our”), builds and operates the hosted KairosAI dashboard and AI workforce platform (the “Service”), which provides AI agents that handle conversations across voice (including PSTN telephony), WhatsApp, Instagram, email and web chat on behalf of businesses, together with built-in business tools including a lightweight CRM, quoting and invoicing, payroll and a people directory. This overview describes the safeguards we have in place. We have written it to be candid: it states what we do and it does not claim certifications or controls we do not currently hold.

Our security programme is designed to meet the “reasonable security safeguards” expected under India’s Digital Personal Data Protection Act, 2023 (the “DPDPA”), read with the Information Technology Act, 2000 and the rules made thereunder. How we handle personal data more generally is described in our Privacy Policyand the controls that apply when we process data on behalf of a customer are set out in our Data Processing Addendum.

1. Data residency & hosting

The Service is hosted on cloud infrastructure in the Mumbai region . Customer account data, billing records and conversation data processed by the Service reside in India. We rely on the cloud provider’s physical and environmental security for the underlying data-centre infrastructure (including facility access controls, power and redundancy) and operate our application and data layers on top of that infrastructure. Certain sub-processors process data outside India. In particular, large-language-model inference runs on our LLM provider and, because we use the LLM provider’s cross-region inference, a prompt and its response may be served from a cloud region outside India. Where that occurs we apply appropriate contractual safeguards and act in accordance with the DPDPA, as described in our Privacy Policy and in the sub-processor list in our Data Processing Addendum.

2. Encryption

We encrypt customer data both in transit and at rest.

• In transit: all traffic between your browser or systems and the Service is protected with TLS. Internal service-to-service traffic within our environment is likewise carried over encrypted channels.
• At rest: databases, object storage and backups are encrypted at rest. Application secrets and sensitive configuration values are additionally protected with AES-GCM authenticated encryption.

3. Multi-tenant isolation

KairosAI is a multi-tenant platform. Every record carries a tenant identifier and every request is scoped to exactly one tenant at the application layer, with automated tests in our build pipeline that assert one tenant cannot read or write another tenant’s data. Underneath that, PostgreSQL row-level security (RLS) is enforced at the database on a least-privilege role that cannot bypass it, so a query that arrives without a tenant context returns no rows. Isolation therefore does not depend solely on application queries filtering correctly: the database denies cross-tenant access by default.

4. Access control & least privilege

We follow the principle of least privilege. Access to production systems and customer data is restricted to the personnel who need it to operate and support the Service and is granted at the minimum level required. Application and infrastructure secrets (such as database credentials, API keys and signing keys) are stored in a managed secrets store and protected with AES-GCM encryption, rather than being hard-coded or distributed in source code. Administrative access to our cloud environment is controlled through scoped identity and access-management roles.

5. Network & perimeter controls

The Service runs within a controlled cloud network with defence-in-depth at the perimeter:

• Security groups: network access to our compute and data resources is restricted by network security groups that allow only required ports and sources, with public exposure minimised.
• Web Application Firewall (WAF): a WAF is applied at our content delivery network (CDN) edge to filter common web-application attacks and abusive traffic before it reaches the application.
• Transport security: the public edge terminates TLS and serves the Service over HTTPS.

6. Logging, monitoring & backups

Administrative write actions (such as configuration, access and data changes made through the dashboard and staff console) are recorded in a tamper-evident, hash-chained audit log, so that an entry cannot be altered or removed without breaking the chain. Administrative read access is not yet audited: we do not currently produce a per-record log of who viewed what, and we are extending audit coverage to read access. We take regular backups of critical data to enable recovery in the event of data loss or corruption and we monitor for operational and security events so that we can respond in a timely way. Security and diagnostic logs are retained for a limited period appropriate to detect, investigate and respond to incidents, as described in our Privacy Policy.

7. Payments & card data

Billing on KairosAI uses a prepaid wallet in Indian Rupees: you top up your wallet in advance and metered usage (such as voice minutes and messages) is debited against the balance. Wallet top-ups and payments are processed by our payment processor, a PCI-DSS compliant payment processor. Card and other sensitive payment credentials are handled by our payment processor within its compliant environment and never touch KairosAI servers: we receive only payment references and status needed to reconcile your wallet. Fees are exclusive of applicable taxes; KairosAI is not currently registered for Goods and Services Tax and GST will be charged with tax invoices issued if and when KairosAI becomes GST-registered.

8. Alignment with the DPDPA

The safeguards described here are intended to satisfy the obligation under the DPDPA to protect personal data with reasonable security safeguards. Where KairosAI processes personal data on behalf of a business customer, the customer is the Data Fiduciary and KairosAI acts as a Data Processor on the customer’s documented instructions under our Data Processing Addendum. In the event of a personal data breach, we will act in accordance with the DPDPA, including notifying affected parties and the Data Protection Board of India as required and assisting our customers with their corresponding obligations.

9. Our security posture & what we do not claim

We believe in being precise about our maturity. KairosAI is an early-stage company and we are continuously strengthening our controls. As of the date above, we do not hold SOC 2, ISO/IEC 27001, or PCI-DSS certification in our own name and we do not represent ourselves as certified under those frameworks. Card-data compliance is achieved by routing all card processing to our payment processor, our PCI-DSS compliant payment processor, so that regulated cardholder data never reaches our systems. We are committed to maturing our programme over time and will update this page as our posture evolves.

10. What we are still building

The following controls are not in place today. We list them so that the sections above can be read for exactly what they say.

• Multi-factor authentication is not available. Sign-in uses a one-time code sent to your email address as the primary factor; there is no second factor and no option to enrol an authenticator app or security key. MFA is on our near-term roadmap.
• Intrusion-detection alerting is partially in place. Threat detection runs against our cloud environment, but its findings are not yet delivered to a monitored on-call channel. Wiring those findings to on-call alerting is in progress.
• Penetration testing: no third-party penetration test of the Service has been carried out to date.

11. Customer responsibilities

Security is a shared responsibility. We ask customers to help protect their accounts by using strong, unique credentials, restricting and reviewing access within their own organisation, configuring data-retention settings appropriately for their use case and complying with applicable requirements when sending commercial communications (including TRAI and DLT registration obligations for messaging) as set out in our Terms & Conditions.

12. Responsible disclosure

We welcome reports from security researchers and users who identify potential vulnerabilities in the Service. If you believe you have found a security issue, please report it to us at security@trykairos.in with enough detail to reproduce and assess the issue. We ask that you:

• give us a reasonable opportunity to investigate and remediate before any public disclosure;
• avoid privacy violations, data destruction, service degradation and any access to or modification of data that does not belong to you; and
• act in good faith and within applicable law, including the Information Technology Act, 2000.

We will acknowledge legitimate reports, work to remediate confirmed issues promptly and keep you informed of our progress. We do not currently operate a paid bug-bounty programme, but we are grateful for responsible disclosures and will credit researchers where appropriate and agreed.

13. Governing law & jurisdiction

This Security Overview is governed by the laws of India. Subject to any arbitration agreed in our Terms & Conditions (seated at Pune, Maharashtra, conducted in English, under the Arbitration and Conciliation Act, 1996), the courts at Pune, Maharashtra shall have exclusive jurisdiction over any dispute arising out of or in connection with this page.

14. Changes to this overview

We may update this Security Overview from time to time as our practices and infrastructure evolve. The “Last updated” date above will change accordingly and material changes may be notified through the dashboard or by email.

15. Contact

For security questions, vulnerability reports, or any data-protection grievance, contact Vishal Khandelwal, Founder at security@trykairos.in, or write to KairosAI Technologies Private Limited, Flat No. E-506, Pristine Allure, S.No. 20/2A, Vadgaon Sheri, Pune City, Pune, 411014, Maharashtra, India.