1. Our commitment
KAYJOR is built to verify economic activity and measure outcomes for sovereign, enterprise, infrastructure, and capital partners. The integrity of that work depends on the integrity of our infrastructure. We treat security as a first-class design constraint, not a bolt-on, and we publish this page so that prospective pilot partners, regulators, and the public can evaluate the controls we operate.
2. Secure development
Our development practices follow these principles:
- Code review. All changes to production code go through pull-request review by at least one other engineer. Sensitive changes (authentication, billing, data access) require review by two engineers.
- Dependency hygiene. We use automated tools to track and update dependencies, and we pin versions in production deployments.
- Secret management. No production credentials are stored in source control. Secrets are managed through a dedicated vault and are rotated on a regular schedule and on personnel changes.
- Static analysis. Automated linters and type checks run on every commit to catch common vulnerability classes (XSS, injection, etc.) before code reaches production.
3. Infrastructure and encryption
Our infrastructure runs on a major cloud provider with industry-standard physical and network security controls:
- TLS everywhere. All client-to-server and server-to-server traffic is encrypted in transit using TLS 1.2 or higher. Plaintext HTTP is redirected to HTTPS.
- Encryption at rest. Persistent data is encrypted at rest using the underlying provider's managed encryption.
- Regional deployment. Pilot deployments can be pinned to specific geographic regions (subject to agreement) to satisfy data-residency requirements.
- Backups. Persistent data is backed up on a regular schedule; backup encryption and retention windows are documented in the pilot agreement.
4. Access control
Access to production systems follows least-privilege principles:
- Authentication. Production access requires multi-factor authentication.
- Authorization. Production roles are scoped to specific functions (deploy, on-call, database read, etc.) and are granted only for the duration of the relevant task.
- Audit logging. Administrative and security-relevant actions are logged and periodically reviewed.
- Onboarding and offboarding. Personnel access is reviewed on a regular cadence and revoked promptly when an individual leaves the team.
5. Data protection
Personal data processed by KAYJOR is handled in accordance with our Privacy Policy and applicable data protection laws. Pilot data, where it falls under additional contractual or regulatory obligations (for example, personal data subject to GDPR, sovereign data subject to national law, or financial data subject to sectoral regulation), is handled under the controls defined in the executed pilot agreement, which supplement the controls described here.
6. Monitoring and detection
We continuously monitor our infrastructure for anomalies, abuse, and security-relevant events. Our monitoring stack includes:
- Application and access logs shipped to a central log aggregator.
- Alerts on defined abuse patterns (for example, the rate limits and honeypot protections on our public pilot-request endpoint).
- Dependency and vulnerability monitoring on production components.
7. Incident response
We maintain a written incident response plan and a defined escalation path. If a security incident materially affects your data or service, we will:
- Notify affected pilot partners without undue delay, in line with contractual notification windows and applicable law.
- Provide a written summary of what happened, what was affected, what we did, and what we are doing to prevent recurrence.
- Where required by law or contract, support any notifications you need to make to your own users, regulators, or counterparties.
8. Vulnerability disclosure
We welcome reports of suspected vulnerabilities in our systems. If you believe you have found a security issue, please contact us at security@kayjor.com with a description of the issue, steps to reproduce, and any relevant logs or screenshots. We will acknowledge within five business days.
We commit to:
- Investigate reported issues in good faith and not pursue legal action against researchers who comply with this policy.
- Keep you informed of remediation progress and credit you for the report in our public security acknowledgments, unless you prefer to remain anonymous.
We ask that you:
- Avoid actions that could degrade our service or compromise the data of our pilot partners.
- Give us a reasonable opportunity to remediate before publicly disclosing a vulnerability.
- Comply with applicable law in your jurisdiction.
TO REVIEW: Consider whether to publish a more detailed coordinated disclosure policy, including safe-harbor language and a scope definition, once the security program matures.
9. Pilot-specific security
Pilot deployments may impose additional security obligations — for example, dedicated infrastructure, customer-managed encryption keys, or specific audit and reporting requirements. The pilot agreement is the authoritative source for those obligations. The controls described on this page are the baseline.
10. Compliance and certifications
KAYJOR is in a 2026 Founding Network and is in the process of establishing formal security certifications. As of the "Last updated" date above, the following are in scope or under preparation:
- SOC 2 Type I — targeted within 12 months of v1.0 GA.
- ISO 27001 — under evaluation.
- GDPR / UK GDPR — in effect; details on the Privacy page.
Pilot partners with specific compliance requirements (for example, HIPAA, FedRAMP, or regional data-protection regimes) should discuss those requirements before entering into a pilot agreement. We are happy to scope additional controls on a per-partner basis.
TO REVIEW: Update the compliance roadmap as the program matures. The above is a sensible baseline for an early-stage pre-product company and should be revisited at each major milestone.
11. Contact the security team
- Security reports: security@kayjor.com
- General inquiries: hello@kayjor.com
For time-sensitive security matters involving a live incident affecting a pilot partner, contact your assigned KAYJOR counterpart directly.