KILOBYTEZ
Principal-led · No certifications claimed

Data Handling

This page says what Kilobytez actually does with your data and access, and it says plainly what it does not have. A vendor who overstates their security posture is the security problem.

What we actually do

These are working practices, not a certified control set. Where a requirement is specific to your organization, it belongs in the engagement agreement, where it is enforceable.

Encryption in transit

Client systems we build use TLS for data in transit and the platform-native encryption at rest offered by the hosting provider we deploy to. Specific requirements are agreed in the engagement, not asserted here as a blanket policy.

Least privilege access

We ask for the narrowest access that lets the work proceed, and we ask you to remove it when the engagement ends. Where read-only or staging access is enough, that is what we request.

Client-owned repositories

Code we write for you lives in a repository you control. Work product ownership is defined in writing in the engagement agreement before any code is committed.

Mutual NDA

We will sign a mutual NDA before any sensitive discussion. One client engagement is already under NDA and is described nowhere on this site, which is the practical demonstration.

No cross-client reuse

No proprietary client code, data, algorithms, or business logic moves between engagements. Anything reusable is either generic or written fresh.

Multi-factor authentication

Accounts used to access client systems have MFA enabled. Credentials are held in a password manager, not in files, chat messages, or code.

Working practices, not a certified control set

  1. 1Mutual NDAWe will sign a mutual NDA before any sensitive discussion.
  2. 2Least privilege accessWe ask for the narrowest access that lets the work proceed, and we ask you to remove it when the engagement ends.
  3. 3Multi-factor authenticationAccounts used to access client systems have MFA enabled.
  4. 4Encryption in transitClient systems we build use TLS for data in transit and the platform-native encryption at rest offered by the hosting provider we deploy to.
  5. 5Client-owned repositoriesCode we write for you lives in a repository you control.
  6. 6No cross-client reuseNo proprietary client code, data, algorithms, or business logic moves between engagements.

What we can and cannot hand your procurement team

If your process requires an item in the right-hand column, we are the wrong vendor for that contract, and it is cheaper for both of us to know that now.

Available on request

  • A signed mutual NDA before sensitive discussions
  • Client-controlled repositories and defined IP ownership
  • Written data-handling terms specific to your engagement
  • Responses to your own security questionnaire
  • A named reference from a past client, on request
  • Public registrations: SAM.gov UEI HE6PUL2P11K1, Texas CMBL 13935177611

We do not have these

  • A SOC 2 report, or a control set formally mapped to the Trust Service Criteria
  • A completed AIMA DDQ on file
  • A documented, tested business continuity plan
  • Formal background-check or security-training programs
  • Round-the-clock monitoring or an on-call rotation

Kilobytez does not currently publish insurance limits. If your contract requires a certificate of insurance, ask before you scope the work and you will get a straight answer about what is in force.

Client data and source code

Least privilege access

Illustrative
  1. Narrowest accessRead-only or staging access where that is enough.
  2. Production data only when necessarySynthetic or anonymized data for development and testing where the work allows it.
  3. Access removedWe ask you to remove it when the engagement ends.

Client Data

  • Production data is accessed only when it is necessary for the work
  • Synthetic or anonymized data is used for development and testing where the work allows it
  • Retention and deletion terms are set per engagement, in writing, rather than promised as a blanket policy
  • Client data is not shared with any third party outside the tools your engagement explicitly approves

Source Code & IP

  • Client-owned code is stored in client-controlled repositories
  • Work product ownership is defined in the engagement agreement before work begins
  • No proprietary client code or algorithms are shared between engagements

AI tooling

Kilobytez uses AI-assisted development tools. Where an engagement restricts what may be sent to a third-party model, that restriction is agreed in writing and the tooling is configured to match before the work starts. Ask about this early; it is easier to scope than to retrofit.

Questions from your security team?

Send the questionnaire. You will get answers, including the ones that say no.

Contact UsAbout Kilobytez