Security
What Kenstow does to keep your company’s documents separate, controlled and traceable. We only list what is built and in use.
Your company’s data is separate
Every company has its own workspace. The separation is enforced in the database itself, not only in the application: a person can only reach data that belongs to their own company. Documents, recorded decisions and the context used for analysis are never mixed between companies, and nothing learned from one company is used for another.
Access levels
Four levels (viewer, editor, approver, owner) decide who can read, change, approve and manage. They are enforced in the database and again in the application, so a missing button is never the only protection. The person who prepares a change and the person who approves it can be different people.
No change without approval
A document’s current file and revision label change only through an approved and released revision. The database rejects any other route, including direct requests that skip the screens.
A record of every change
Each document keeps its revision history: every earlier file, what changed, who approved it and when. Decisions recorded on a case or a follow-up are kept with the case.
Sign-in
Passwords must be at least 12 characters and contain letters and numbers, and can be reset by an email link. Team members join by a one-time invitation link that expires and is tied to the invited email address; only a hash of the link is stored.
Browser protections
Kenstow tells browsers to use HTTPS only, not to be framed by other sites, not to guess file types, and not to use the camera, microphone or location. Invitation pages are also kept out of search engines and do not pass the link on to other sites.
How documents are analysed
Only the short excerpts a request needs are sent to the language model provider, never a whole library. Under the provider’s commercial terms it may not train on this content. Details and the provider’s retention period are in the privacy notice, and all providers are on the sub-processors page.
What we do not have yet
Kenstow does not currently hold ISO 27001 or SOC 2 certification. When that changes, we will say so here.
Report a security problem
If you think you have found a vulnerability, write to [contact email address]. Please give us a reasonable time to fix it before sharing it, and do not access other people’s data.