- Encryption in transit. All traffic to the API, website, and docs uses TLS 1.2 or later.
- No content at rest. Prompts and completions are processed in memory and excluded from logs.
- Hashed keys. API keys are stored as salted hashes and shown only once at creation.
- Least privilege. Production access is role-based and requires multi-factor authentication.
Reporting a vulnerability
Email support@kurrens.ai with the subject line “Security report”, steps to reproduce, and any proof of concept. Please give us reasonable time to fix the issue before disclosing it publicly.
Jailbreaks, prompts that produce harmful output, and model hallucinations are not security vulnerabilities — report model misuse to support@kurrens.ai with the subject line “Abuse report”.
More at kurrens.ai/security.