Transparency is the foundation of enterprise trust. Here you will find everything you need to evaluate K0nsult's security posture, data protection practices, and compliance alignment.
Enterprise-grade infrastructure with defense-in-depth across every layer of the stack.
All application components run within isolated private networks. Database access is restricted to application-level connections only — no public database endpoints. Inter-service communication uses encrypted internal DNS. Edge routing with DDoS protection at the CDN layer.
All responses include the following security headers (verifiable via curl -sI https://k0nsult.fly.dev/health):
X-Powered-By header is removed (helmet.js). Verify: curl -sI https://k0nsult.fly.dev/health | grep -i x-powered returns empty.
We collect the minimum data necessary and keep it within the EU.
Multi-layered access control ensures only authorized users and systems interact with your data.
Our platform is designed with regulatory requirements in mind from the ground up.
K0nsult provides alignment support for the EU AI Act. Our governance framework includes risk classification assistance, human oversight mechanisms, transparency documentation, and agent registry that supports compliance documentation requirements.
Our AI management system principles are aligned with ISO/IEC 42001 requirements. We maintain documented processes for AI lifecycle management, risk assessment, and continuous improvement that follow the standard's framework.
K0nsult is built for GDPR compliance. EU data residency, data minimization, right to erasure, data portability, explicit consent mechanisms, 72-hour breach notification, Data Processing Agreement (DPA) available for all enterprise clients. Our Privacy Policy and Terms of Service are fully aligned with GDPR requirements.
Every agent operates within strict boundaries with mandatory human oversight.
Clear, documented procedures for detecting, responding to, and recovering from security incidents.
Report security vulnerabilities or concerns: security@k0nsult.dev. Responsible disclosure is welcome. We commit to acknowledging reports within 24 hours and providing an initial assessment within 72 hours.
We welcome responsible security research and are committed to working with the community to resolve vulnerabilities.
Out of scope: Third-party services, social engineering, denial of service
We will not pursue legal action against researchers acting in good faith. Good faith means: no accessing or modifying other users' data, no degrading service availability, and promptly reporting findings to security@k0nsult.dev.
Defined recovery objectives ensure your data is protected and services can be restored quickly.
Granular permissions mapped to each role, enforcing least-privilege across the platform.
| Role | Agent Registry | Mission Control | Audit Logs | Admin Panel | Billing |
|---|---|---|---|---|---|
| Owner | Full | Full | Full | Full | Full |
| Admin | Read/Write | Read/Write | Read | Read/Write | Read |
| Operator | Read/Write | Read/Write | Read | None | None |
| Auditor | Read | Read | Full | Read | None |
| Guest | Read (public) | None | None | None | None |
Comprehensive, immutable logging of all security-relevant events across the platform.
{
"timestamp": "2026-03-23T01:24:00Z",
"actor": "agent-k02",
"action": "process_assessment",
"resource": "client-intake-42",
"result": "success",
"ip": "10.0.0.1"
}
Every log entry follows this structured JSON format, enabling automated analysis, compliance reporting, and forensic investigation when needed.
Regular access reviews ensure permissions remain appropriate and least-privilege is maintained.
All sensitive credentials are managed with strict controls to prevent exposure and ensure timely rotation.
Defined retention periods ensure logs are available for compliance and forensic purposes, while being responsibly archived and deleted.
| Log Type | Retention Period |
|---|---|
| Security event logs | 36 months |
| Application logs | 12 months |
| Access logs | 12 months |
| Audit trail | 36 months (or client contract duration, whichever is longer) |
| Backup logs | 6 months |
Logs are automatically archived after their retention period and permanently deleted after an additional archive period of 12 months.
Enterprise clients can use this checklist to evaluate K0nsult's security posture as part of their vendor assessment process.
Need help completing this checklist? Contact security@k0nsult.dev and we will schedule a security walkthrough.
We maintain a minimal sub-processor footprint to reduce risk.
| Sub-processor | Service | Location | Data Processed | Status |
|---|---|---|---|---|
| Fly.io | Application hosting & compute | Frankfurt, Germany (EU) | Application data, user sessions | Active |
| PostgreSQL (Fly.io Managed) | Database hosting | Frankfurt, Germany (EU) | All persistent data | Active |
All the documentation your procurement and security teams need, ready for review.
Tiered availability commitments that match your business requirements.
| Metric | Starter | Professional | Enterprise |
|---|---|---|---|
| Uptime SLA | 99.0% | 99.5% | 99.9% |
| Max Monthly Downtime | ~7h 18m | ~3h 39m | ~43m |
| Maintenance Window | Sunday 02:00-06:00 CET | Sunday 02:00-04:00 CET | Coordinated, 48h notice |
| Incident Response | Best effort | < 4 hours | < 1 hour |
| Status Updates | Email + dashboard | Email + dashboard + Slack |
Questions about our security posture? Need documentation for your review? Responsible disclosure? We are here to help.
Responsible disclosure is welcome. We acknowledge all reports within 24 hours.