Security

Every write to user-owned data traverses three independent layers. A silent failure at any one is a full security failure, so each layer is tested in isolation and as a chain. The first layer is row-level security at the database: Supabase Postgres policies guard each table so the underlying rows are unreachable without a verified tenant identity, even from a service-role connection.

The second layer is the REST API at api.kiln3d.com, which validates every bearer token, derives the tenant identity from the verified claim, and rejects opaque or caller-supplied identifiers with a 401. The third is the tool layer: any operation that accepts a caller-supplied tenant or org identifier is flagged as local-only and refused over HTTP, so admin surfaces cannot be reached from outside the operator’s own machine.

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256, vendor-managed via Supabase + AWS). Secrets are stored exclusively in Fly.io managed-secret storage and never written to disk on application instances.

We publish honest status labels. A standard listed here as Planned or Roadmap is exactly that — we do not claim certifications we do not hold.

Kiln retains a 7-year hash-chained audit log capturing authentication events, license validations, tool dispatches, and design mutations. Live tables hold the operational window; rows aging past 60 days are written to a tamper-evident offline archive (gzip JSONL plus SHA-256 chained to the previous batch) before deletion.

The chain is the integrity surface: every archive batch embeds the SHA-256 of the previous batch, so a modification to any row breaks the chain across every batch that follows it. An auditor verifying a single archive transitively verifies the whole history. This matches the SOC 2 Type II ceiling most auditors apply and is a superset of the HIPAA six-year retention requirement.

• SSO via OIDC and SAML for Okta, Azure AD, Google Workspace, and any compliant IdP, available at the Enterprise tier.
• MFA required on Business and Enterprise tiers as of 2026-05-23. TOTP and WebAuthn are both supported; recovery codes are issued at enrolment.
• Per-org RBAC — Admin, Engineer, and Operator roles, scoped per organisation.
• API tokens with rotation and scope limits, surfaced in the workshop’s Settings → Security screen for self-serve management.

Primary data residency is the United States: Supabase Postgres in us-east-1, the REST API on Fly.io in LAX and IAD. Transfers to the EU are protected by Standard Contractual Clauses and the EU-US Data Privacy Framework, with vendor-side technical measures (encryption in transit and at rest, audit logging, tenant scoping) layered above.

We currently use 12 subprocessors, listed in full at /subprocessors. Top three by data volume:

• Supabase (managed Postgres + Auth)
• Fly.io (REST API hosting)
• Stripe (subscription billing)

We commit to 30 days’ prior written notice before adding a new subprocessor that processes paid-tier customer data, with a contractual objection window for Enterprise customers.

• Pro / Business: 99.5% monthly availability target with service credits.
• Enterprise (single-tenant): 99.9% monthly availability target with service credits, on a multi-region warm topology.
• Status page: status.kiln3d.com →
• Full SLA: available in the MSA and Order Form. Request from procurement →

• Coordinated disclosure: 90 days from confirmed report.
• Email: security@kiln3d.com. Do not file public GitHub issues for security-sensitive reports.
• PGP key: available on request.
• Breach notification: within 24 hours of confirmed breach to affected customers, and within 72 hours to authorities under GDPR Art. 33 / CCPA §1798.82.

On request under NDA: SOC 2 gap assessment, BAA template, MSA / DPA / Order Form, CAIQ + SIG Lite responses, single-tenant runbook, penetration test report (when delivered), source code escrow option.

Public: Privacy Policy, Terms of Service (draft), this Security page, the Subprocessor list.

For procurement queries: adam@kiln3d.com.