Security

Self-hosted and air-gap-capableby construction.

Not a policy promise — an architectural one. Every component that touches your code, your data, or your credentials is designed to run entirely inside your own network, with no dependency on Kryex Labs' own infrastructure ever being reachable at all.

Credentials never reach the client

A database password, an upstream model API key — masked to its last few characters even to an administrator, used only inside the one backend process that executes the call.

orders_db.passwordsk_live_••••••••••••7f21

Every check is live, not cached

Suspension, quota, and grant state are re-verified on the actual request — never trusted from a claim baked into a license token issued up to 24 hours earlier.

Default deny, everywhere

No configuration state in Kryex ever defaults to permissive. The absence of a grant is a denial, full stop — never an oversight to be caught later.

Fail closed on ambiguity

An unrecognized SQL statement, an unrecognized browser action, an unparseable URL — every classifier treats what it doesn't understand as the highest-risk category, never the lowest.

The evidence trail

Every decision writes one event. The chain proves none were edited.

Append-only, hash-chained — each event's hash incorporates the one before it, the same tamper-evidence construction built to survive an audit challenge of “how do we know this log wasn't altered after the fact?” There is no code path in Kryex that updates or deletes an audit row. One real session, four linked events:

Dev B reads the orders database.

2026-08-05 09:12:03 UTC

Allowed — grant G-118 gives Dev B READ on orders_db.

Dev B's agent tries to write to the same database.

2026-08-05 09:14:41 UTC

Blocked before it ran — there is no grant on file that permits a write.

Dev B requests write access, with a reason.

2026-08-05 09:15:02 UTC

“Hotfix — bad price on order 43.” Lands directly in the admin's approvals inbox.

An admin grants WRITE, scoped to Dev B's own team.

2026-08-05 09:22:18 UTC

The grant is bounded — team/payments only, not the whole database.

Live, not cached

A suspended account is blocked on the next call. Not eventually — now.

A license proves it was valid when issued. It says nothing about whether the account has been suspended since. So Kryex never trusts the license alone — suspension, quota, and grant state are re-verified on the actual request, every time.

Cached-token approachTrusts the license claim until it naturally expires.
Window of continued access: up to 24 hours
Kryex — live checkRe-reads account status from Kryex Cloud on this exact request.
Window of continued access: one request
Enterprise identity

Federated identity, not a second directory to manage.

Once live, authentication for Kryex Desktop and Kryex Admin flows entirely through your own identity provider — Kryex never becomes a separately-managed identity source inside your organization. The grants engine already treats groups as first-class principals today, built from day one to become live mirrors of your real directory groups.

Microsoft Entra IDSAML / OIDC
Planned
OktaSAML / OIDC
Planned
SCIM directory syncProvisioning · de-provisioning · group sync
Planned
Compliance path
In progressSOC 2 Type I
PlannedISO 27001
PlannedHIPAA path
PlannedFedRAMP path

Have a security questionnaire?

Send it over — we'll fill it out against the architecture, not a template.

Request a security review
CtrlI