Data security
Your data, protected and confidential at every step
Encryption, access control, supervised administration, AI under control: this is how K.IOP protects your data, and what you can strengthen to meet your CISO's requirements.
At a glance
- Encryption in transit and at rest
- Encrypted fields only you can read
- On a dedicated instance, access limited to your network
- Administration through a logged bastion
- Your data trains no AI model
Your data stays yours
It is isolated per customer, never used to train a model, and you can export or delete it at any time. Your sources only change through a workflow you trigger.
Data encryption, from the network to the browser
Your data is encrypted in transport and in storage. For the most sensitive of it, encryption happens in the user's browser.
-
In transit
Every exchange between browsers, the platform and your data sources is encrypted.
-
At rest
The data stored on our servers is encrypted. A copied or stolen disk yields nothing readable.
-
In the browser, for your sensitive fields
You choose the fields to protect: they are encrypted in the browser with a key you hold. Only the users who have the key can read them, our own teams included.
-
Your own keys
The encryption keys can be yours, managed under your own policy.
Access control and authentication
Every access goes through the user's identity and their rights. On a dedicated instance and on-premise, you add single sign-on, two-factor authentication and network control.
-
Single sign-on
On a dedicated instance and on-premise, your users sign in with their company account. Someone switched off on your side is switched off in K.IOP too.
-
Two-factor authentication
On a dedicated instance and on-premise, a second factor is required at sign-in, and you can enforce it across the whole organisation.
-
Roles and permissions
Each user sees and changes only what their role allows.
-
Access limited to your network
On a dedicated instance and on-premise, you set the allowed IP addresses. A connection from anywhere else is refused, even with valid credentials.
Infrastructure administration, controlled and logged
Technical access to the infrastructure is as controlled as your users' access.
-
An administration bastion
Every administrative access to the servers goes through a single bastion, reachable only over VPN. Every session there is logged.
-
A complete audit log
Every operation is logged: you know who did what, when, and on which data.
-
Isolation per customer
On the shared cloud, each organisation's data is isolated. On a dedicated instance, it has servers of its own.
-
On-premise, an access you control
Our access to your installation goes through a channel you open and can close at any time.
AI
AI and data confidentiality
Cleaning, rules and calculations run without a language model. Only the assistant and the AI steps of workflows call a model, and you are the one who chooses it.
- A cleaning engine with no language model
- Your data never trains a model
- The model of your choice: a market model, yours with your own key, or an open-source model hosted at your site
- AI can be switched off for the whole organisation
Your rights over your data
-
Export and reversibility
You export your data at any time, in open formats, including at the end of the contract.
-
Deletion
You delete a record, a table or your whole organisation whenever you decide.
-
GDPR
You remain the controller of your data, we process it on your behalf, and a data processing agreement frames our role.
Frequently asked questions
What happens to a field encrypted in the browser?
Only users who hold the key can read it. K.IOP therefore cannot clean it, search it or send it to the AI. Keep it for the most sensitive fields: identity numbers, confidential amounts, health data. Store the key carefully: without it, the field can no longer be decrypted.
Is our data used to train an AI model?
No, never. And if you do not want it to leave your infrastructure, choose an open-source model hosted on your instance or at your site, or switch AI off.
Can we limit access to our network?
Yes, on a dedicated instance or on-premise: you declare the allowed IP addresses, and any connection from another address is refused. On the shared cloud, the infrastructure is shared between organisations, so this filtering is not offered there.
Where is our data hosted?
In France on the shared cloud, in the country of your choice on a dedicated instance, in your own infrastructure on-premise. The details are on the Hosting and deployment page.
Going further
-
Where the platform runs
Hosting and deployment
Shared cloud, dedicated instance or on-premise: which infrastructure for which data, and the care that comes with it.
See the deployment modes -
The legal framework
Privacy policy
Which data we process, why, for how long, and how to exercise your rights.
Read the policy
Let's talk about your CISO's requirements
Security questionnaire, architecture review, hosting conditions: an expert answers you.
- Browser-side encryption
- IP-based access
- Logged bastion