Security Measures

1. Encryption

In transit

• All communication between clients and the Service is encrypted using TLS 1.2 or higher.
• API endpoints enforce HTTPS; plaintext HTTP connections are rejected.
• Inter-service traffic travels over a private VPC network; backend service ports accept connections only from inside that network, not from the public internet.

At rest

• All stored data — source code, indexes, embeddings, metadata, and backups — is encrypted at rest using AES-256.
• Encryption keys are managed through the cloud provider's key management service (KMS) with automatic rotation.

2. Access controls

• Access to production systems is restricted to authorized personnel using multi-factor authentication (MFA).
• Production access follows the principle of least privilege; access is granted only as needed and reviewed regularly.
• Customer data access by Keyes AI personnel requires explicit justification and is logged.
• API access is authenticated via scoped personal access tokens with configurable, per-token permissions.

3. Tenant isolation

• Customer data is logically isolated at the engine level. Each tenant's repositories, indexes, and embeddings are inaccessible to other tenants.
• Isolation is enforced at the data layer, not solely at the application layer.
• Enterprise self-hosted deployments provide full physical isolation on customer-owned infrastructure.

4. Audit logging

• On plans that include audit logging (Ultra and Enterprise), API operations — reads, writes, commits, searches, and administrative actions — are logged with timestamps and identity.
• Audit logging is enabled per organization; Enterprise policy can require it across all member organizations.
• Logs include the identity of the actor (human or AI agent), the operation performed, and the resources accessed.
• Audit logs are retained for 90 days and available to account administrators through the dashboard's audit viewer, with filtering by operation and target path.

5. Infrastructure security

• The Service runs on Google Cloud Platform (GCP) infrastructure in secured, access-controlled data centers.
• Network perimeters are protected by firewalls, intrusion detection, and DDoS mitigation.
• Production servers run hardened operating systems with automated patching.
• Infrastructure is provisioned as code and changes are reviewed before deployment.

6. Application security

• The GitDB engine is built in Rust, which eliminates entire classes of memory-safety vulnerabilities by design.
• Dependencies are scanned for known vulnerabilities and updated regularly.
• Code changes undergo peer review before deployment to production.

7. Data backup and recovery

• Customer data is backed up continuously to dedicated cloud storage.
• Backups are encrypted at rest using the same AES-256 standard as primary storage.
• Recovery procedures are tested regularly to ensure data can be restored within defined recovery objectives.

8. Incident response

• We maintain a documented incident response plan covering identification, containment, eradication, recovery, and post-incident review.
• In the event of a data breach affecting customer data, we will notify affected customers without undue delay after becoming aware of the breach, as described in our Terms of Service.
• Post-incident reviews are conducted for all significant incidents, and findings are used to improve our security posture.

9. Employee security

• All employees with access to customer data undergo background checks.
• Employees receive security awareness training on an ongoing basis.
• Access to production systems is revoked immediately upon employee departure.

10. Vulnerability management

• We conduct regular vulnerability assessments and penetration testing.
• Security researchers may report vulnerabilities to security@keyes.ai. We commit to acknowledging reports within 48 hours.
• Critical vulnerabilities are prioritized and remediated promptly.