Protect the knowledge without exposing the person.
KEPT is built to keep customer knowledge separated, restrict access, and maintain evidence of important security and data events.
What is live, in progress and planned
Every control is written down and checkable. The DPA and the subprocessor list are published, and business customers can subscribe to subprocessor updates.
Audit targeted for November 2026
In progress with VantaInformation security management
In progress with VantaAI management system
In progress with VantaDPA and subprocessors published
In progress with VantaSafeguards mapped for a BAA
In progress with VantaEvery control, with its status
- SAML single sign-onLive
- Okta, Microsoft Entra ID, Google Workspace. A workspace can require single sign-on for everyone in it.
- SCIM 2.0 provisioningLive
- Included with the business plan alongside SAML: your identity provider adds and removes people, and a workspace admin mints and revokes the credential.
- Two-factor and workspace policyLive
- Authenticator-app codes for any account. Owners and admins can require a second factor for everyone, end idle sessions, and restrict the networks the workspace is reachable from. Each person sees their active sessions and can sign out everywhere.
- Row-level securityLive
- Enforced in the database. Access decisions are made by the control plane, never by an AI model, and privacy rules are tested in our build pipeline on every change.
- Encryption and hostingLive
- Encrypted in transit and at rest. Hosted in the United States: Supabase for the database and sign-in, Render for services, Vercel for the web.
- Audit log and data exportLive
- Owners and admins can export the workspace audit ledger over a date range, as JSON or CSV. Each person can download a complete copy of what Kept has captured for them.
- Immutable transcripts and legal holdLive
- A session transcript cannot be edited or deleted once recorded; the database refuses the change. A hold keeps the records it names until it is released, whatever else would delete them.
- No training on your dataLive
- Kept does not train models on your data. Our model providers, Anthropic, OpenAI and ElevenLabs, are contractually prohibited from training on it.
- SOC 2 Type IIn progress
- In progress with Vanta. Audit date targeted for November 2026. A penetration test is planned, arranged through Vanta.
- ISO 27001In progress
- In progress with Vanta. The information security management system is being built on the same controls as the SOC 2 work.
- ISO 42001In progress
- In progress with Vanta. The AI management system: how models are chosen, gated and monitored, and how every answer stays cited or marked unknown.
- GDPRIn progress
- In progress with Vanta. The DPA, the subprocessor list and the retention and erasure controls are published today; the framework mapping is being completed.
- HIPAAIn progress
- In progress with Vanta. Kept does not process protected health information today; the safeguards are being mapped so a covered entity can be supported under a business associate agreement.
Current controls
Workspace isolation
Customer information is scoped by workspace. Database row-level security and service authorization are designed to deny cross-workspace access by default.
Role-based access
Administrative actions and knowledge access depend on authenticated roles and explicit permissions. Knowledge-sharing grants are scoped to the people and workspace involved. Access decisions are made by the control plane, never by an AI model: the AI layer receives only minimized, already-authorized context for each request.
Private attachment storage
Uploaded files are stored in private object storage and retrieved through authorized service paths. Deleting an attachment is designed to queue its stored file for removal.
Protected service boundaries
The public web application communicates with dedicated control-plane and AI services. Secrets and provider credentials are held in managed deployment environments rather than shipped to the browser.
Auditing
KEPT is built to record important authorization, security, consent, deletion, and model-processing events to support investigation and accountability.
AI-provider controls
AI requests are routed through KEPT's model gateway and recorded in an operational ledger. KEPT does not use customer content to train generalized AI models. Provider retention and no-training terms are governed by KEPT's provider agreements and live account configuration.
Data deletion
KEPT builds audited deletion paths for captured partner data and private attachments. Some limited billing, audit, security, consent, or legal records may be retained when permitted or required.
Reporting a vulnerability
To report a suspected vulnerability or security issue, contact support@kept.solutions. Please do not include active credentials or customer data in the initial message. We acknowledge reports, keep the reporter informed while we investigate, and credit reporters who want credit once a fix ships.
We welcome good-faith security research. If you make a good-faith effort to respect user privacy, avoid disrupting the service, access only your own test data, and give us reasonable time to fix an issue before disclosing it, we will not pursue or support legal action against your research. This policy is also published at /.well-known/security.txt.