Security

Last updated: 9 September 2026

This page describes how we approach security for this website and for the systems we build. It is written to be checkable rather than reassuring: where something is an intention rather than an implemented control, it says so.

Reporting a vulnerability

If you believe you have found a security issue, email nithin@kognisol.in with enough detail to reproduce it. Please give us a reasonable opportunity to fix it before disclosing publicly. We will not pursue legal action against good-faith research that avoids privacy violations, data destruction, and service degradation.

A machine-readable version of this is at /.well-known/security.txt.

Website controls

• HTTPS is enforced, with HSTS including subdomains.
• A Content Security Policy restricts which origins may load scripts, frames and images.
• X-Content-Type-Options, a framing policy, a referrer policy and a permissions policy are set.
• The public chat endpoint applies rate limiting, message size limits, and server-side validation of the request, including rejecting client-supplied conversation roles.
• Model output is rendered as text, not as markup, so a reply cannot inject scripts into the page.
• Provider API keys are held server-side as environment variables and are never sent to the browser.

How we build client systems

• Least privilege. Integrations get the narrowest scope that makes the workflow work.
• Client-owned credentials. Wherever possible, systems run on the client's own accounts, so access does not depend on us.
• Approval points. Consequential actions are designed to need a human decision.
• Auditability. Automations log what they did, without logging secrets or unnecessary personal data.
• Handover. At the end of an engagement the client holds the accounts, configuration and documentation. Any continuing access we hold is agreed explicitly rather than assumed.

Subprocessors

The services that process data on our behalf for this website are listed in the Privacy Policy. For a current list suitable for procurement, or for a data processing addendum, email nithin@kognisol.in.

What this page does not claim

We hold no security certification, and we do not claim compliance with any regulatory framework we have not implemented and verified. If your procurement process needs a specific control set, ask and we will tell you honestly whether we meet it today.