Security approach

Access control

• Client access is invite-only and scoped to the client organization.
• Staff and client roles are separated, with authorization checked on every protected request.
• Integration credentials and application secrets are kept server-side and are not exposed to browser code.

Authentication

• Passwords are stored using a modern one-way password hashing algorithm.
• Login, password reset, and session flows use secure transport and rate limiting.
• Multi-factor authentication or enterprise SSO should be enabled for staff and any client account handling sensitive data before production use.

Application and data protection

• Database access uses prepared statements and least-privilege application credentials.
• Forms use request validation, CSRF protection where appropriate, spam controls, and generic authentication errors.
• Uploaded files are type-checked, size-limited, stored outside direct public access, and downloaded only after authorization.
• Operational data, backups, retention, and deletion are handled according to the project agreement.

AI-specific controls

• Workflows define approved data sources, permitted actions, and human review points.
• High-impact or irreversible actions require explicit approval or an agreed control mechanism.
• Prompts, outputs, model providers, and retention settings are reviewed as part of the solution design.
• We do not claim a security certification or regulatory compliance unless it is expressly documented and current.

Reporting a security issue

If you believe you have found a security issue, use the Kairact project inquiry form and begin the message with “Security issue.” Do not include passwords, private keys, patient information, or other sensitive data in the form.