Security Policy.
You trust Kantrix with the way your sites run, and we treat that as our first responsibility. This policy states the security commitments we make to every customer and partner. For how the platform is built, see the Security page.
SOC 2 Type 2
Kantrix does not hold a SOC 2 report yet. We are preparing for a SOC 2 Type 2 examination by an independent CPA firm, against the AICPA Trust Services Criteria for security.
A Type 2 report covers more than the design of our controls on a single day. It tests whether they worked throughout an observation period of several months. We are building our controls to that standard now, so the period can begin as soon as they are in place.
When we have the report, customers and partners can ask us for a copy under a non-disclosure agreement. Until then, our security overview answers the standard vendor review questions in writing, and we will tell you where we are in the examination whenever you ask.
Our security program
Our information security program is written down. It sets out how we:
- assess risks to Kantrix and to the data we hold, at least once a year and whenever the platform changes in a way that affects them;
- control who can reach our systems and your data, and review that access regularly;
- build, test, sign and release software;
- monitor the platform, and respond to incidents;
- choose and review the providers we rely on.
The program is approved by our leadership team, which reviews it at least once a year.
How Kantrix keeps your data safe
Your workloads stay on your nodes
Virtual machine and container disks, and the data in them, stay on the nodes you control. The control plane, which we run, holds the records of your sites, nodes and workloads that the portal needs. Every connection between a node and the control plane starts at the node, over TLS with a verified certificate and a token unique to that node. A node needs no inbound connection from the internet.
Access is limited and checked on every request
- The server checks every request against the person's role and the clients and sites they are scoped to.
- Every user can add an authenticator app as a second sign-in step, and an organization's admins can require it of every member. Every Kantrix staff member must use one.
- API tokens never carry more access than the person who made them, and always expire: after 90 days by default, and after one year at most.
- Kantrix staff cannot open a console or shell on your nodes. Our platform staff can see the inventory in the portal, but not inside your VM disks.
Credentials are encrypted
Connections to the control plane use TLS 1.2 or later. The control plane's database, cache and file storage are encrypted at rest, and so are the database's backups. Credentials for the services you connect, and the VM logins Kantrix generates, are encrypted again with keys held in AWS Key Management Service.
Every change is recorded
The activity log records every change, with who made it, when and with what role. No one can edit or delete it, including Kantrix staff.
Software is checked before it reaches your hardware
- Tests run on every change, and again in the release build, before anything is published.
- Releases are signed. Nodes and the installer check the signature and checksum before they install anything.
- Each release pins exact image digests, and a published image can't be overwritten.
- On an installed node, the local root and admin accounts are locked. Signing in at the console needs portal credentials.
The platform is watched around the clock
The control plane's database runs in two separate AWS availability zones at once, so it keeps running if either one fails. A checker in a second AWS region tests the portal every minute and publishes the results at status.kantrix.io. Our Service Level Agreement sets out the availability we commit to.
Our providers
The control plane runs on Amazon Web Services in the United States. We only use providers that commit, in writing, to protect the data they handle for us, and we review them before we start and at least once a year. Our Privacy Policy names each provider that handles personal information and what it does.
Security incidents
We keep a written incident response plan, and we test it at least once a year.
If we confirm a security incident that affects your data, we will tell you without undue delay. We will explain what happened, what data it affects, what we have done about it and what you may need to do. We will keep you informed until it is resolved. If you are a partner, we will tell you about every incident that affects your clients, and help you inform them.
Reporting a vulnerability
If you find a vulnerability in Kantrix, email security@kantrix.io with what you found and how to reproduce it. We will acknowledge your report and keep you updated while we fix it. Research that follows the rules in our Acceptable Use Policy is welcome, and we won't bring a legal claim against you for it.
Your part
Security is shared between us. Kantrix secures the platform and the control plane. You, or your partner, secure what you control, including:
- the physical security of your nodes and the networks they connect to;
- the operating systems, applications and data inside your virtual machines and containers, and their backups;
- who you give access to, the roles you give them, and whether they protect their sign-in with an authenticator app or a passkey;
- keeping your nodes on a supported release.
Contact
Questions about this policy, or requests for the security overview: security@kantrix.io.