Trust

About this page

This page is maintained by the Airlock team to answer common security and privacy questions. It describes current, app-visible controls — not an independent certification.

Authentication & access

• Email and password sign-in with password reset via email.
• Optional Google sign-in.
• Role-based access control inside each organization (owner, admin, developer, approver, auditor).
• Row-level security is enforced on every tenant-scoped table.

How Airlock handles your provider keys

• Airlock uses a bring-your-own-key model for AI providers. When you connect an OpenAI key in Settings → Providers, Airlock stores it encrypted in the managed secrets store (Supabase Vault), separate from the application database.
• Raw keys are never written to normal application tables.
• Raw keys are never written to audit_events or audit_prompts. Audit rows record only the key source (byok or platform) and an internal connection identifier.
• Raw keys are read server-side only at the moment a request is forwarded to the provider, and are never returned to the browser or included in gateway responses.
• Disabling or revoking a connection destroys Airlock's stored copy of the key. It does not revoke the key at OpenAI — rotate or delete it in your OpenAI dashboard as well if that is your intent.

Platform & hosting

Airlock runs on a managed cloud platform (managed Postgres, managed auth, edge-served application code). Backups and infrastructure hardening are provided by the underlying platform. This is not a certification.

Data we collect

• Account data: name, email, and optional profile fields you provide.
• Application configuration: applications, API key metadata (never the plaintext key after issuance), and policies.
• Gateway usage: request metadata (timestamps, request/correlation IDs, decisions, policy version).
• Raw prompts and responses are only persisted when the matching policy sets audit_mode to 'redacted' or 'full', per your configuration.

Sensitive data handling

• Built-in detectors: email, phone, SSN, credit card (Luhn-validated), and org-defined custom regex.
• Detected values can be redacted, warned, blocked, or routed for human approval based on the active policy.
• Raw sensitive values are never persisted unless the policy's audit_mode is set to 'full'.

Audit trail

• Every gateway request writes exactly one primary audit row, plus one follow-up row per approval decision or delivery retry.
• Audit rows are append-only: the database revokes UPDATE and DELETE on audit_events, and a trigger blocks mutation attempts at the row level.
• Prompts and responses are stored in a separate audit_prompts table only when the matching policy's audit_mode is 'redacted' or 'full'.

Human approval lifecycle

Requests that hit a policy requiring human approval are held in a pending state and never forwarded until an approver decides. The decision lifecycle (pending, approved, rejected, expired) is tracked separately from the delivery lifecycle (delivered, failed, retrying) so an approved request whose provider call fails — for example because the provider connection was disabled between approval and delivery — can be retried explicitly without re-opening the approval. Every attempt writes its own audit row.

Subprocessors

Airlock routes requests to the AI providers you configure (OpenAI at MVP). Additional subprocessors used to operate the service are listed on request — email support@KinetIQ.com.

Retention & deletion

Audit retention varies by plan. You can request account deletion at any time; deletion removes your organizations, applications, policies, keys, and audit events, subject to any legal hold.

Incident & security contact

Report a suspected security issue to support@KinetIQ.com. We acknowledge reports on receipt and coordinate remediation with the reporter.

Shared responsibility

Airlock provides governance primitives — policies, detectors, approvals, and audit. You are responsible for configuring policies that match your regulatory and business obligations, keeping API keys secret, and reviewing audit output. Your end users are governed by your own terms.

Compliance

Airlock does not currently advertise formal compliance certifications. Contact support@KinetIQ.com to discuss your specific requirements.