Last updated: January 1, 2026
Template notice
This is placeholder text shipped with the Kestral template. Replace it with your own policy before publishing — it is not legal advice.
Infrastructure
Kestral runs on SOC 2 certified cloud providers in isolated environments per customer. Production access requires hardware-key MFA and is logged and reviewed. Scale customers can run the control plane inside their own VPC.
Encryption
All traffic is encrypted in transit with TLS 1.2 or higher. Data at rest is encrypted with AES-256. Provider API keys you store with us are encrypted with a per-customer key and are never written to logs.
Access control
Role-based access, SSO (SAML and OIDC) and SCIM provisioning are available on the Scale plan. Every action in the dashboard is recorded in an audit log you can export.
Guardrails and isolation
Agent runs execute in sandboxed workers with network egress limited to the tools you approve. Policy checks run before and after every tool call and block actions that violate your rules.
Monitoring and incident response
We monitor the platform around the clock and publish incidents at status.yourcompany.com. Affected customers are notified within 72 hours of a confirmed data incident, in line with GDPR.
Compliance
SOC 2 Type II report and penetration test summaries are available under NDA. GDPR data-processing agreement available on request. Replace this list with your actual certifications.
Responsible disclosure
Found something? Email security@yourcompany.com with details and steps to reproduce. We respond within 2 business days, do not pursue good-faith researchers, and credit fixes publicly if you want us to.