Security

Your data stays yours.

Plain answers to the questions owners ask first.

How we protect it

How we protect it.

Only the controls we actually run, described as they are.

A private serverYour system runs on its own server, with its own database and encryption keys. Nothing is shared with other customers.

Encrypted throughoutYour data is encrypted while it moves and while it is stored.

Nothing goes out without your OKNo email, post or payment leaves the system until a person approves it.

A log you can checkEvery login, admin change and support visit is written to a tamper-evident log, kept with your system.

Locked-down accessKey-only server access, a firewall that blocks everything by default, and protection against password guessing.

Strong sign-inPasswords of 12 characters or more, and a one-time code by email on each new device.

Daily malware scansEvery server is scanned every day, and anything found is flagged right away.

Backups every nightEncrypted, stored apart from your server, and tested by restoring them.

Never used to train AIWe train no AI models, and it's written into our agreement.

If you ever leave

Your data comes with you.

Everything the system produced for you, plain-English runbooks of how your processes were set up, and your own logins, within 14 days. Your data is never held hostage.

Where we stand

What we don't claim.

We'd rather tell you where we stand than oversell it.

SOC 2Not certified yet. We're working toward it, and we'll always tell you exactly where we stand.

Penetration testingWe haven't had an independent test yet.

Health recordsWe're not a HIPAA business associate, so the system isn't for patient health information.

Questions

Who can see my data?

Your team, with the permissions you set, and our team when building and supporting your system. Every visit is written to your log.

Where is it stored?

On a private server dedicated to your business, encrypted at rest.

Can my team use AI without personal accounts?

Yes. Your team uses AI inside one private system instead of ten personal accounts, and you keep the visibility.

What if I want out?

Cancel at the end of your term and you get your data back, complete, within 14 days.

Can I see your policies?

Yes. Security policy → Data processing terms → Or email info@k2asolutions.com.

Your data stays yours.

How we protect it.

Your data comes with you.

What we don't claim.

Questions

Let's build yours.