Security and governance are the core of Kairos — not an add-on. Every request that passes through the gateway is inspected, governed, metered, and logged. This page describes the controls the platform actually enforces.
Last updated: June 2026
Before any content reaches a model provider, Kairos applies:
When a user repeatedly trips firewall, DLP, or compliance rules, Kairos automatically quarantines them — blocking further LLM usage until an administrator reviews the incident. Admins can drill into the exact prompts that triggered each flag, then restore access or ban the user. Quarantined and banned users are refused at the gateway.
Kairos enforces role-based access control at both the organization and Command Center level, with per-feature permissions resolved on the server for every request. Command Centers form a hierarchy with scoped privileges and sub-organization isolation, so usage, cost, and configuration visibility follow the principle of least privilege.
API keys are stored only as salted bcrypt hashes — never in plaintext — and can be scoped to a single Command Center, revoked, or budget-capped. Authentication for the dashboard is handled by Clerk; provider keys are encrypted at rest.
Successful governed gateway request logs are SHA-256 hash-chained per organization and Command Center and include the effective governance hash. Verification detects sequence, previous-hash, record-hash, and chain-head inconsistencies. This is tamper-evident application evidence, not immutable storage; export availability depends on the evidence surface and caller scope.
Sherlock gateway rules can block matching Kairos-routed calls before provider dispatch. An elevated managed agent can apply provider/domain blocks to its own hosts file, while DNS or firewall coverage requires a customer-managed connector to consume the domain feed. A normal endpoint does not become a whole-network inline enforcement point, and Kairos does not claim broad TLS decryption or SASE coverage.
Hard budget caps can be set per API key, agent, or team. When a budget is exceeded, requests are blocked at the gateway rather than merely alerted on.
Kairos is built to align with SOC 2, HIPAA, and FedRAMP control families and continuously maps its enforcement to 22 AI/LLM compliance mandates, reviewed against authoritative sources every 90 days. Formal certification status and a current controls matrix are available to enterprise customers on request.
We welcome responsible disclosure. Please report suspected vulnerabilities to [email protected]. We will acknowledge reports promptly and keep you informed through resolution.