Security BaselineVersion: v1.0Updated: October 2026
Security & Incident Response
Details Kairo's technical security architecture, Row-Level Security, vulnerability disclosure, and breach response procedures.
Audience: Security teams, enterprise compliance evaluators, and security researchers
Developer: Zambezi Digital
Official Policy Publication — Enforced Standards
This document is an active, binding operational policy published by Zambezi Digital governing the security, data privacy, and usage regulations of Kairo OS across all jurisdictions.
On this page
1. Security Architecture & Isolation
Kairo enforces defense-in-depth across every layer:
• Multi-Tenant Isolation: Enforced at the database level via PostgreSQL Row-Level Security (RLS) policies scoped by organization_id.
• Cryptographic Standards: TLS 1.3 in transit and AES-256 for data at rest.
• Secret Management: Server-side environment isolation; API keys and database credentials never reach client bundles.
Key takeaway: Database-level RLS, TLS 1.3, AES-256, and zero client secrets.
2. Vulnerability Disclosure & Bug Bounty Protocol
We welcome responsible security research. If you discover a vulnerability, report it confidentially to security@zambezidigital.agency. Please include reproducible steps, do not alter or exfiltrate customer data, and allow reasonable time for remediation prior to public disclosure.
Key takeaway: Report vulnerabilities safely to security@zambezidigital.com.
3. Incident Response Lifecycle
Our incident protocol comprises 6 structured phases: (1) Triage & Identification, (2) Containment & Session Revocation, (3) Forensic Investigation, (4) Remediation, (5) Regulatory & Customer Notification within 72 hours, and (6) Post-Mortem Hardening.
Key takeaway: Structured 6-phase incident response with statutory 72-hour notifications.
Have questions about this policy?
Our legal and privacy desk is available for corporate inquiries.