Type II Certified
AES Data Encryption
Historical Uptime
Disaster RPO Target
01Security Posture & Architecture
At Kiko.one, security is not an afterthought or an add-on module—it is an architectural foundation. Because our unified operating system coordinates core business components (HR personnel databases, payroll runs, sales leads, deal pipelines, and operations), we enforce zero-trust defense across all software microservices and personnel operations.
Our information security management system (ISMS) is overseen by our Chief Information Security Officer (CISO) and validated through continuous internal audits and accredited third-party reviews.
02Compliance & Certifications
SOC 2 Type II
Audited annually by independent AICPA-accredited CPA firms covering the Trust Services Criteria for Security, Availability, and Confidentiality.
GDPR & UK GDPR
Full European Union data protection compliance with standard Data Processing Addenda (DPA), Article 30 records, and EU residency options.
HIPAA Readiness
Enterprise subscribers subject to HIPAA privacy requirements may execute Business Associate Agreements (BAA) with enhanced audit logging.
03Encryption & Cryptography
All external traffic to Kiko.one web applications, mobile endpoints, and APIs requires HTTPS with TLS 1.3 (or fallback TLS 1.2 with secure cipher suites). We enforce HTTP Strict Transport Security (HSTS) with preloading to block unencrypted protocol downgrade attacks.
All production databases, key-value caches, persistent block storage volumes, and cold backup archives are encrypted using industry-standard Advanced Encryption Standard with 256-bit keys (AES-256). Cryptographic encryption keys are managed through AWS KMS with automatic annual key rotation.
04Infrastructure & Tenant Isolation
Kiko.one services run in physically secure, SOC 2 / ISO 27001 certified AWS data centers spanning multiple Availability Zones (AZs) for high availability and zero single points of failure.
- Logical Multi-Tenant Isolation: Data rows and file objects are strictly partitioned by cryptographic tenant identifiers with Row-Level Security (RLS) enforced at the database kernel layer.
- Edge DDoS Protection: Protected by Cloudflare Magic Transit and Web Application Firewalls (WAF) blocking OWASP Top 10 exploits, Layer 3/4 SYN floods, and Layer 7 volumetric anomalies.
- Dedicated Enterprise VPCs: Enterprise tier customers may opt for single-tenant VPC deployments with private AWS PrivateLink interconnects.
05Identity, SSO & Access Control
Seamless integration with enterprise identity providers including Okta, Microsoft Entra ID (Azure AD), Google Workspace, and OneLogin for single-click employee provisioning and instant deprovisioning.
Configure field-level view and edit rights across HR payroll, performance notes, CRM deal values, and administrative system settings.
06Penetration Testing & SAST/DAST
We practice proactive offensive security to continuously stress-test our codebase and production infrastructure:
- Third-Party Pentesting: Independent, CREST-accredited security firms perform comprehensive annual white-box and grey-box penetration tests across web apps, APIs, and cloud configurations.
- CI/CD Code Scans: Automated Static Application Security Testing (SAST) and Software Composition Analysis (SCA) run on every git pull request before deployment to production.
- Container Scanning: Container base images are scanned continuously against public CVE databases for newly published vulnerabilities.
07Incident Response & 24h SLA
Our dedicated Security Incident Response Team (SIRT) maintains automated 24/7 SIEM alert triage. In the event of a verified security breach impacting Customer Data:
Kiko guarantees notification to affected workspace administrative contacts without undue delay and within 24 hours of confirmation, accompanied by root-cause remediation details.
08Business Continuity & RPO / RTO
Kiko maintains automated snapshotting and continuous transaction WAL archiving to geographically isolated storage tiers. Our disaster recovery objectives include:
Maximum data loss window in an extreme catastrophic cloud outage.
Target turnaround to restore full platform services in a secondary AWS region.
09Responsible Vulnerability Disclosure
We deeply appreciate ethical security researchers who help maintain a safe internet. If you have identified a vulnerability within any Kiko.one domain or API, please report it via PGP-encrypted email to:
legal@kiko.one
Please do not engage in activities that cause service disruption, compromise customer records, or violate privacy. We commit to acknowledging receipt within 24 hours and providing regular remediation updates.
10Requesting SOC 2 & Security Packet
Enterprise procurement teams, compliance officers, and infosec auditors can request our complete Enterprise Security Packet, which includes:
- Latest SOC 2 Type II Examination Report
- Standard CAIQ / SIG Security Questionnaire
- Executive Pentest Summary Report
- Enterprise Data Processing Addendum (DPA)