Security and Compliance

Built to Pass the Security Questionnaire

The answers your security team will ask for, one line each.

Single Sign-On: OIDC or SAML through your identity provider, set up on request. Your identity provider decides who gets in.
Provisioning: SCIM ends a membership the minute your directory deactivates or deletes somebody. Their work stays with the team.
Two-Factor: Optional two-factor with backup codes, passkeys and security keys. Once on, no sign in method skips it. Every account confirms its email first.
Audit Log: Every sign in, invitation, role change and removal in a workspace, with who and when, for its admins. Nothing from elsewhere.
Permissions: Owner, admin and member set the defaults, adjustable per person. The assistant runs with the permissions of whoever uses it.
Your Data: Export everything Kilter holds about a person as one file, and everything a workspace shares as another. Erasing an account removes their personal data and keeps the team’s work.
Secrets at Rest: Integration tokens, model keys and sign-on secrets are encrypted at rest. A sign-on provider’s secret is never stored in the database.
Nothing Waved Through: If a security check cannot run, the request is refused. The server never fetches private addresses, cross-site requests change nothing, and logs carry no secrets.
Bill of Materials: Every package, with its license and checksum, as a CycloneDX file at app.kilter.work/sbom.cdx.json. Rebuilt with every release.
Every Deploy Gated: A security advisory against any dependency blocks the build until it is fixed or explained in writing. Nothing ships that did not pass.

Vulnerability Disclosure

How to Report a Vulnerability

Write to support@kilter.work with “Security” in the subject. The same address is in our security.txt.

What to Include: What you found and where: the address, the request, and the kind of account it needs. The steps that show it, and what you believe somebody could do with it. A short report that reproduces is worth more than a long one that does not.
What We Ask: Test only with accounts and workspaces that are yours. Do not read, change or delete anybody else’s data, do not slow the service down for other people, and stop once the problem is shown. Give us time to fix it before you tell anyone else.
What Happens Next: We confirm the report arrived within five business days, tell you whether we could reproduce it, and tell you when it is fixed. We ask you to wait ninety days from your report, or until the fix is released if that comes first, before telling anyone else, and we will agree a later date with you if a fix needs longer.
Safe Harbor: If you follow this policy in good faith, Wyzie LLC will not bring a legal claim against you or report you to law enforcement for your research, and treats it as authorized under the Computer Fraud and Abuse Act, similar laws, and the security testing rule in our terms. If somebody else brings a claim over research that followed this policy, we will make clear that it was authorized. This does not cover anything that breaks the law in other ways or goes past what this policy allows.
In Scope: kilter.work, app.kilter.work, the Kilter desktop app, and the services they call on Kilter’s behalf.
Not in Scope: The outside accounts a person connects and the model providers a workspace connects: report those to the vendor. Also social engineering, attacks that need physical access to somebody’s device, denials of service, and scanner output with no demonstrated impact.
Rewards: Kilter does not pay for reports. With your permission, we credit you by name when the fix is announced.