Security · Kennan AI
How Kennan handles MNPI, from the infrastructure layer up.
Built on GCP, with per-org isolation enforced at three layers and vendor data paths constrained by contract. The public posture is laid out below; the SOC 2 review packet is available under DPA.
The five sections below cover the underlying infrastructure, how one tenant is isolated from another, who sees what data, what we inherit from the cloud provider, and what we commit to on our own. For review materials, DPA execution, or vulnerability disclosure: security@kennan.ai.
§ 1 · Substrate
What this product runs on.
GCP — and only GCP — sits in the MNPI data path. Every infrastructure layer has a port interface, so deploying into a customer's own VPC — on the roadmap — is a configuration change rather than a codebase fork.
Compute
GCP Cloud Run · Gen2 microVM
Hardware-VMM isolation between instances — the same primitive Google uses for App Engine and Cloud Functions inside its own multi-tenant fleet. The boundary holds even if the kernel-layer sandbox is escaped.
Application database
Cloud SQL on GCP
Managed Postgres on Cloud SQL, encrypted at rest. Row-Level Security is enforced at the database layer; details under Isolation.
Object storage
Google Cloud Storage
Every object key carries a per-tenant prefix (org/{org_id}/workspace/{workspace_id}/). AES-256 server-side encryption by default.
Secrets
GCP Secret Manager
Credentials are pulled at deploy time. Integration API keys (data connectors, other vendor APIs) are held only by pointer, and never appear in the application database or in logs.
Identity
First-party auth + Google sign-in
Session tokens validated on every request. Passwords stored as scrypt hashes only; Google sign-in via OAuth 2.0 for accounts that prefer it. No third-party identity provider sits in the data path.
Models
Anthropic Claude · OpenAI · Google Gemini
Claude runs the agent; OpenAI reads the PDFs you add, with Google Gemini as the fallback reader. None of them trains on your data. How long each retains prompts and outputs is governed by its own terms.
§ 2 · Isolation
Three layers of isolation, enforced five ways.
Tenant separation lives in the application, in the database, and in the physical substrate — three independent layers, the five concrete mechanisms below. Each would catch a missing scope filter on its own; they exist together because a cross-tenant leak in financial work isn’t a bug ticket, it’s an incident report.
§ 3 · Data path
Outside parties in the data path.
Every outside vendor that touches the product is named below — what it sees, and the contract that constrains it. Explicitly, rather than gesturing at “trusted subprocessors.”
Anthropic Claude API
The agent that does the work: prompts, tool calls, and outputs during a request.
Signed DPA; never used for training. How long Anthropic retains prompts and outputs is governed by Anthropic's terms.
OpenAI API
Rendered page images of the PDFs you add — uploaded, or pulled from a connected Box or Dropbox — at parse time. OpenAI is our primary PDF reader.
Signed DPA; never used for training. How long OpenAI retains what it processes is governed by OpenAI's terms.
Google Gemini API
Rendered page images of a PDF, only when the primary reader fails on it.
Google's paid Gemini API terms; never used for training. How long Google retains what it processes is governed by Google's terms.
LlamaParse
PowerPoint files and images you add, and a PDF only when both readers above fail on it — only at parse time.
Signed DPA and a no-training commitment. How long LlamaParse retains documents is governed by its terms.
Box · Dropbox (only if you connect one)
Kennan’s requests to list, search, and download files in your account, search terms included, made with the read-only access you granted. Kennan uploads nothing to them.
Your own agreement with Box or Dropbox governs the files. The access token is held in Google Secret Manager, never in the application database or in logs, and cannot edit, move, delete, or share anything. Disconnect in Settings › Data Sources.
Serper (web search)
The search queries the agent issues during research — never your documents, prompts, or outputs.
Standard API terms. Queries travel under our platform key with no tenant identity attached; note that a query can name the subject of your research, so what the agent is asked to research is under your control.
Stripe
Billing identity — name, email, subscription state. Card details are entered on Stripe’s own checkout surface and never touch our servers.
PCI DSS Level 1 service provider, standard DPA. Sees billing state, not tenant business data.
Resend
Your email address and the content of transactional messages — verification links, receipts.
Standard DPA. Transactional email only; document content and workspace data never route through it.
Google Cloud Platform
Everything on the substrate — compute, storage, database, secrets.
Google Cloud DPA. ISO 27001 / 27017 / 27018, SOC 1 / 2 / 3, FedRAMP High, HIPAA BAA, PCI DSS, C5, IRAP. Encryption at rest by default; CMEK available for enterprise customers.
Vercel
Frontend HTML, static assets, route metadata.
Standard DPA. Business data is fetched directly by the browser from the API server (also on GCP); Vercel’s CDN edge never caches tenant data.
§ 4 · Compliance
Compliance posture and ongoing commitments.
GCP’s own compliance program covers the cloud infrastructure. Our own audit and the contracts we commit to on top are listed in the cells below. Anything not covered here is the kind of thing we’d walk through under DPA.
Substrate compliance
Inherited from GCP
ISO 27001 / 27017 / 27018. SOC 1 / 2 / 3. FedRAMP High. HIPAA BAA. PCI DSS. C5. IRAP. Encryption at rest by default, with CMEK available for enterprise customers.
Application-layer controls
SOC 2 Type II · program underway
We're building toward a SOC 2 Type II report. In the meantime we share an interim review packet under DPA: three-layer isolation evidence, secret-handling posture, vendor data-path attestations, and the vulnerability-disclosure process.
Data-handling commitments
DPA
In force today: a DPA on request. How long each AI vendor retains what it processes is governed by that vendor’s terms, named in the data path above. Integration credentials live only in Secret Manager, with just an opaque pointer stored in the application database.
Customer-VPC deployment
Port-swap architecture · roadmap
Every infrastructure layer (compute, Postgres, object storage, secrets, integration credentials) has a port interface. Deploying into a customer’s own GCP, AWS, or Azure tenancy is a configuration change rather than a codebase fork. The customer’s compliance team then reviews their own infrastructure, not ours.
§ 5 · Contact
Reaching security.
One inbox handles review packets, DPA execution, security questionnaires, and vulnerability disclosure. It’s monitored by someone on the team, and you’ll usually hear back within a day.
Security · DPA · disclosures
For SOC 2 review materials, DPA requests, and vulnerability disclosures. Please describe the in-scope workflow and the institution you’re reaching out from.
For sales, press, or careers, see the full contact menu.