Security
Security at Knull.
How we protect your data, the credentials you connect, and the actions Knull is allowed to take. Stated plainly, including what is not done yet.
01Data
- Encryption
- Data is encrypted in transit with TLS 1.2 or later and at rest with AES-256.
- Workspace isolation
- Every table holding customer data has row-level security scoped to the owning workspace, so the database itself refuses cross-workspace reads.
- Export
- Workspace data can be exported from Settings at any time.
02Credentials
- Connected accounts
- OAuth grants for connected tools are held in a dedicated credential vault, not passed to the browser.
- Least access
- Each connector requests the permissions for the capabilities you use and lists its reads and actions publicly on the integrations page.
- Disconnect
- Disconnecting a tool removes the grant and stops its scheduled pulls.
03Access and actions
- Sign-in
- Email and Google sign-in. Admin accounts require time-based two-factor authentication. Password resets are rate-limited and single-use.
- Authority gates
- Spending, publishing and sending wait for approval unless an Authority rule allows them, within caps you set.
- Receipts and audit
- Consequential actions write a receipt; administrative changes are written to an audit log.
04Continuity
- Backups
- The primary database is backed up continuously with point-in-time recovery.
- Restore rehearsal
- A full restore rehearsal has not yet been completed. We will publish the date and result once it has.
- Status
- Platform health is published on the status page.
05Posture
- Compliance
- SOC 2 Type I is in preparation. We do not hold a finished certification and will not claim one we do not have. GDPR and CCPA obligations are honoured today.
- Sub-processors
- The current list is on the sub-processors page.
- Responsible disclosure
- Email security@knullos.lovable.app. We acknowledge within two business days and will not pursue legal action against good-faith researchers who avoid privacy violations, disruption and data destruction.
Everything else, in one place.
Privacy, legal documents, status and our compliance posture live in the trust centre.