1. Data protection, and what backs each claim
A data processing agreement, binding automatically
It carries the terms Article 28(3) requires and applies from signup. You do not have to request it, negotiate it, or reach a sales team to get one. Read the DPA.
Every sub-processor listed, with what each one receives
Including which ones never receive anything about a person at all, which is most of them. See the register.
Erasure and subject access as API endpoints
POST /v1/forget and POST /v1/subject. A controller answering a subject request calls them from their own backend. Deletion runs across every table and reclaims the storage, so an erased record leaves the file rather than sitting on a freelist. See the API.
Retention enforced by a job, not by a sentence in a policy
A daily sweep deletes past each plan’s window and logs the run. Raw IP addresses are not retained at all. The windows were re-measured against real reuse patterns in August 2026 rather than picked to sound responsible.
Consent required before our SDK collects anything
The browser packages take a required consentvalue with no default, so an integration does not compile until the operator states whether consent was granted, denied, or assessed as not applicable. That obligation is the site operator’s under ePrivacy Article 5(3), and shipping a default that walked them into it was our bug. Fixed in the 2.0 packages. See the quickstart.
A named controller, and a route to exercise your rights
Alex Mugo, trading as Kaidn, Nairobi, Kenya, at support@kaidn.io. Article 13 requires a data subject to be told who holds their data and how to reach them, and a surprising number of vendors carrying a compliance badge do not say. See the policy.
A DPIA, a record of processing, and a legitimate interests assessment
Maintained internally under Article 30 and Article 35, updated in the same commit as the change that affects them, and produced to a supervisory authority or to your DPO under the audit clause of the DPA on request.
2. What we do not have
Written plainly because you will find out anyway, and finding out later is worse than reading it here.
No SOC 2 report. Readiness work started on 25 August 2026: there is a dated gap assessment against the AICPA Common Criteria, scoped to Security, listing 14 controls substantially in place and 12 gaps. What that means precisely: no auditor is engaged, no observation window has begun, and no report exists. A Type II report needs three to twelve months of observation after an auditor starts, so if you need one today we do not have it.
We will send you the gap assessment if you ask, including the gaps. It is worth asking any vendor claiming “SOC 2 in progress” who their auditor is and what the target date is, because the phrase is unregulated and frequently means nothing has begun. Ours means a gap assessment exists and the remediation order is written down.
No ISO 27001. Same position.
No encryption at rest on the database volume yet. The disk is not encrypted, so this protects against neither disk theft nor a snapshot leaving the host. It is a known gap in our own records rather than something we discovered when you asked.
We are early. Kaidn is a small operation, not a company with a compliance department. If your procurement process requires an audited certification today, we are not the right vendor yet and we would rather say so now than after a two month evaluation.
3. Security measures actually in place
- TLS everywhere, with certificates issued and renewed automatically.
- API keys are stored as hashes, never in plaintext, and shown once at creation. A leaked key is rotated from the dashboard.
- Entity hashes in the cross-operator graph are HMAC keyed with a secret held only in the server environment, so a stolen database does not yield reversible identifiers for small-keyspace values like an IP or a phone number.
- The service refuses to start in production if either cryptographic secret is missing, rather than degrading quietly to reversible hashes.
- Raw email addresses, IP addresses and phone numbers are not retained on scored events.
- Secrets live in the server environment only and are never committed.
4. Ask us anything specific
Security questionnaires are welcome and we will answer them honestly, including the questions where the answer is no. Write to support@kaidn.io. If a claim on this page matters to your decision, ask for the evidence behind it and we will send it.