Security and Compliance

Built to Pass the Security Questionnaire

The answers your security team will ask for, one line each.

Single Sign-On: SAML and OIDC, so Okta, Entra ID, Google Workspace and Auth0 all work as they are. Your identity provider decides who gets in, and Kilter never holds a password for them.
Provisioning: SCIM, both spellings. When your directory deactivates or deletes somebody, their membership ends the same minute, and the work they made stays with the team.
Two-Factor: A second lock behind the first for anyone who wants it, with backup codes, and a verified address before an account is anybody’s at all.
Audit Log: Every sign in, invitation, role change and removal in a workspace, with who did it and when, readable by its admins. What a person does elsewhere is not in it.
Permissions: Owner, admin and member set the defaults. Each person’s can then be widened or narrowed one switch at a time, and the assistant runs under theirs.
Your Data: Everything held about a person, as one file they can take away. Erasure empties the account and leaves the team’s work where it was.
Secrets at Rest: Integration tokens, model keys and sign-on secrets are encrypted before they are stored, and a provider’s secret is never written to a table at all.
Nothing Waved Through: A guard that cannot run refuses. The server fetches only addresses it can name, and every log line carries a request reference with the secrets taken out.
Every Deploy Gated: A dependency advisory blocks the build until it is fixed or answered for in writing. Nothing ships that did not pass.

Vulnerability Disclosure

How to Report a Vulnerability

Write to support@kilter.work with “Security” in the subject. The same address is in our security.txt.

What to Include: What you found and where: the address, the request, and the kind of account it needs. The steps that show it, and what you believe somebody could do with it. A short report that reproduces is worth more than a long one that does not.
What We Ask: Test only with accounts and workspaces that are yours. Do not read, change or delete anybody else’s data, do not slow the service down for other people, and stop once the problem is shown. Give us time to fix it before you tell anyone else.
What Happens Next: We confirm the report arrived within five business days, tell you whether we could reproduce it, and tell you when it is fixed. We ask you to wait ninety days from your report, or until the fix is released if that comes first, before telling anyone else, and we will agree a later date with you if a fix needs longer.
Safe Harbor: If you follow this policy in good faith, Wyzie LLC will not bring a legal claim against you or report you to law enforcement for your research, and treats it as authorized under the Computer Fraud and Abuse Act, similar laws, and the security testing rule in our terms. If somebody else brings a claim over research that followed this policy, we will make clear that it was authorized. This does not cover anything that breaks the law in other ways or goes past what this policy allows.
In Scope: kilter.work, app.kilter.work, the Kilter desktop app, and the services they call on Kilter’s behalf.
Not in Scope: The outside accounts a person connects and the model providers a workspace connects: report those to the vendor. Also social engineering, attacks that need physical access to somebody’s device, denials of service, and scanner output with no demonstrated impact.
Rewards: Kilter does not pay for reports. With your permission, we credit you by name when the fix is announced.