Kairos Security Framework
Architecture
| Model | Where it runs | Recommended for |
|---|---|---|
| On-premise | Client equipment | Healthcare, banking, sensitive data |
| Client cloud | Client’s AWS / Azure / GCP | Companies with cloud IT |
| Kairos cloud | Infrastructure managed by Kairos | Non-sensitive data only (public chatbots, reports) |
Controls
- Identity and access: least privilege, MFA, named accounts and revocation upon departure.
- Secrets: credentials only in secure managers (Keychain / Key Vault / Secrets Manager), never in code.
- Code: private repositories, file allow-list, automatic privacy reviewer and a pre-commit hook that blocks personal data.
- Data: minimization, encryption in transit, logs with no personal data (only counts, statuses and technical identifiers).
- Safe operation: simulation mode, verification after every action, canary and alarms that stop the run, login retry limit.
- Quality: tests with fictitious cases, 100% audited pilot and weekly samples in production.
- Incidents: classification by severity, client notified in under 1 hour if critical, post-mortem report.
- Continuity: documented procedures, operations manual and safe stop.
- People: NDA, privacy training and assignment of intellectual property.
Compliance
- Law 81 of 2019 on Personal Data Protection (Panama).
- Data Processing Agreement (DPA) in every contract.
- Roadmap: alignment with ISO/IEC 27001 and ISO/IEC 42001.