Backend source of truth
Sensitive actions should be enforced server-side through role, plan, billing and workspace checks, not only hidden in the UI.
Security & Trust
Built for controlled AI operations, without pretending trust is automatic.
Kadryn is designed for teams running AI in production who need visibility, ownership, guardrails and auditability without exposing secrets or unnecessary data.
Principles
Security starts with the way the product is designed.
Kadryn’s security model is built around server-side authorization, tenant isolation, minimal data exposure and controlled integrations.
Tenant boundaries
Business objects should always be scoped to the organization or workspace that owns them.
Secrets stay protected
API keys, provider tokens, OAuth credentials and webhook secrets should never appear in dashboards, logs or audit payloads in clear text.
Decisions stay auditable
Changes to budgets, routing, policies, exceptions and integrations should leave a clear operational trail.
Controls
Controls for AI FinOps workflows.
Kadryn separates access, secrets, delivery, observability and governance so AI cost control does not become another security blind spot.
Identity
Access and permissions
Access is organized around users, organizations, roles and plan-aware capabilities.
Organization roles
Owner, admin, member and viewer flows for workspace-level control.
SSO readiness
Google OAuth, OIDC/SAML and SCIM-oriented workflows depending on plan.
Enterprise access controls
Advanced RBAC, custom roles, SSO group mapping and stricter access policies.
Secrets
Keys, tokens and webhooks
Provider credentials and delivery secrets are treated as sensitive operational material.
Hashed Kadryn API keys
Application keys should be stored as hashes with only a displayable prefix.
Encrypted provider credentials
Provider keys and OAuth tokens should be encrypted at rest and never returned raw.
Signed webhooks
Webhook delivery should use signatures, timestamps, idempotency and retries.
Data
Metadata-first processing
Kadryn is designed to reason from cost and operational metadata instead of collecting unnecessary sensitive content.
Cost attribution metadata
Provider, model, project, feature, team, customer and owner context.
Retention by plan
Retention windows can vary by plan and data category.
Export discipline
Sensitive exports should be role-checked, scoped and auditable.
Operations
Monitoring and incident handling
Production trust depends on diagnostics, redacted logs, safe errors and controlled incident workflows.
Operational monitoring
Errors, background jobs, webhooks, email delivery and integration health.
Audit-oriented traces
Sensitive changes should be recorded with actor, action, target and outcome.
Incident response workflow
Containment, investigation, correction, communication and post-incident review.
Data boundaries
Kadryn should not become a dumping ground for sensitive prompts.
AI FinOps works best when operational metadata is enough to understand cost, ownership and risk. Customers should avoid sending secrets, unnecessary personal data or sensitive raw content into fields that are not designed for it.
- Use metadata such as project, feature, team, environment and owner.
- Avoid storing raw secrets, access tokens, passwords or unredacted provider payloads.
- Keep prompts and payloads minimized when they are not needed for cost operations.
- Review integrations and exports before giving broad access to additional users.
Trust documents
The security page should connect to the legal and trust layer.
Security is not only a marketing claim. Customers need access to privacy, DPA, subprocessors, support and implementation guidance.
Privacy
How Kadryn handles personal data across the site, SaaS service, support and billing.
Open →
Data Processing Addendum
How Kadryn processes customer data when acting as processor.
Open →
Subprocessors
Infrastructure, email, billing, observability and integration providers.
Open →
Documentation
Implementation guidance for gateway, ingestion, integrations and production setup.
Open →
Security contact
Contact Kadryn for security, privacy, implementation or enterprise questions.
Open →
Need a security review before connecting production usage?
Start with a minimal setup, review the data you plan to send, and add stricter controls as your AI usage becomes business-critical.