> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kadoa.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Learn more about our data security practices and compliance measures.

## Overview

Kadoa is built with best-in-class security practices to keep your data safe and secure at every layer.
This includes state-of-the-art encryption, safe and reliable infrastructure partners, and independently verified security controls.

Request our Data Processing Agreement (DPA) for specific details.

## Shared responsibility

Under our shared responsibility model, Kadoa secures the components that we control, including the application layer, underlying platform, and cloud infrastructure.
This includes protecting against threats targeting these components through security controls, monitoring, and incident response.

Customers are responsible for how they use Kadoa.
This includes configuring workspace security and access, determining what data they extract, managing API keys and integrations, and monitoring their audit log.

## Governance

Kadoa establishes policies and controls, monitors compliance with those controls, and proves the security and compliance to third-party auditors.

Our policies are based on the following foundational principles:

<CardGroup cols={2}>
  <Card title="Least Priviledge">
    Access should be limited to only those with a legitimate business needs,
    based on the principle of least privilege.
  </Card>

  <Card title="Consistency">
    Security controls should be applied consistently across all areas of the
    enterprise.
  </Card>

  <Card title="Defense in Depth">
    Security controls should be implemented and layered according to the
    principle of defense-in-depth.
  </Card>

  <Card title="Continuous Improvement">
    The implementation of controls should be iterative, continuously improving
    effectiveness and decreasing friction.
  </Card>
</CardGroup>

## Data Protection

<Card title="Data at rest">All data stores are encrypted at rest.</Card>

<Card title="Data in transit">
  Kadoa uses TLS 1.3 or higher everywhere data is transmitted over networks.
</Card>

<Card title="Data backup">
  Kadoa backs-up all production data using a point-in-time approach. Backups are
  persisted for 30 days, and are globally replicated for resiliency against
  regional disasters.
</Card>

## Data Isolation

Kadoa implements strict data isolation to ensure complete privacy between teams and customers:

* **Complete Team Separation**: Each team's data is fully isolated. No data is ever shared or accessible between teams
* **API Scope Enforcement**: API keys are strictly scoped to individual teams and cannot access data from other teams
* **Isolated Processing**: Workflow executions happen in isolated environments with team-level boundaries
* **Database-Level Security**: Row-level security policies and team identifiers ensure data separation at the storage layer

## Data Regions

When starting on ouer Enterprise Plan, you have the option to select the region where you want your data to be stored. The available options are:

* United States
* European Union

## Certifications

Kadoa is SOC 2 certified. This certification validates our security controls, data handling practices, and operational procedures through independent third-party auditing.

Visit our **[Trust Center](https://trust.kadoa.com)** to review certifications, request access to compliance documents, and download security policies.

For additional questions, contact [security@kadoa.com](mailto:security@kadoa.com).

## Product Security

### Penetration testing

Kadoa engages with third-party firms to conduct penetration testing at least annually.

All areas of the Kadoa product and cloud infrastructure are in-scope for these assessments, and source code is fully available to testers to maximize effectiveness and coverage.

### Vulnerability scanning

Kadoa uses multiple vulnerability monitoring techniques including code-level scanning, dependency scanning, and security reviews to identify and remediate vulnerabilities.

Vulnerabilities are prioritized based on severity and risk, and are remediated according to a schedule.

### Prompt injection

Kadoa uses large language models (LLMs) to build web data pipelines. Because web content is untrusted, a page could contain text crafted to hijack the model and make it ignore its task. This is known as *indirect prompt injection*, and it is an inherent, not-fully-solvable risk of any system that applies LLMs to external content.

We treat it as inevitable and our goal is to ensure that if it does happen, it cannot cause harm. We do this with defense-in-depth, where each layer limits the blast radius of the layer above it:

* **Limited tool access**: our models are constrained to web scraping tasks. They have no tools to call external systems, send data anywhere, or change your configuration, so instructions hidden in a page have nothing to act on.
* **Isolated execution**: all workflow execution runs in isolated, containerized sandbox environments with boundaries kept as tight as possible, at both the workflow and team level.
* **Least privilege**: each workflow runs with only the access it needs, so an injection can never do more than the workflow itself is permitted to do.
* **Continuous testing**: prompt injection is in scope for our regular third-party penetration tests, and we run ongoing internal adversarial testing to catch model regressions over time.

The most damaging prompt injection scenario requires three things at once: access to sensitive data, exposure to untrusted content, and a way to send data out. Untrusted content is unavoidable for a web data platform, so we prevent the other two and keep even a successful injection contained.

## Responsible Disclosure

To report a vulnerability, please reach out to [security@kadoa.com](mailto:security@kadoa.com)