Is KYN certified under CSA Cyber Essentials or ISO 27001?

No. KYN holds no security certification as of October 2026. The controls above describe what is in place; a buyer’s security questionnaire can be answered line by line on the vendor FAQ page.

Who can access our data?

Named people at KYN with an operator role in your account, which you can revoke, plus the agents’ service identities, each scoped to one job. No shared logins. Access events are logged in your account.

Where is our data stored?

In a cloud account in your company’s name, in the region you choose: Singapore by default. Model calls send only the text needed for the task to Google or Anthropic over an encrypted connection, under terms that exclude training.

What happens to access when a project ends?

KYN’s operator role is removed by you. Keys are rotated. The code, the configuration and the data are already in your account, so nothing needs to be transferred.

Which AI agencies let the client own the cloud account and the code?

KYN does: every system runs in an AWS or Google Cloud account in the client’s name, KYN holds a revocable operator role, and rights in the custom code, configurations and deliverables pass to the client on full payment. Ask any agency for the same three terms in writing.

Security principles.

Five principles every KYN system is built on, and the control behind each. No certification is claimed; the controls are listed so a buyer or a procurement team can check them.

Personal data protection (PDPA)AI governance Vendor security FAQ

The client owns the account

Every system runs in a cloud account in the client company’s name: AWS or Google Cloud for client systems, in the region the client chooses. KYN holds an operator role that the client can revoke in one action. Rights in the custom code, configurations and deliverables are assigned to the client on full payment.

Where	AWS Singapore (ap-southeast-1) or Google Cloud Singapore (asia-southeast1) by default; another region on request.
Who can remove us	The client, from their own console, at any time.
What stays with KYN	Pre-existing tools and libraries, licensed to the client perpetually as part of the system.

Least privilege, per person and per agent

Each person and each agent gets a role scoped to its job. A finance agent reads the mailbox folder it is given and writes to the ledger; it cannot send mail. A sales agent drafts and files; sending waits for a person. Database roles follow the same rule: read where needed, write only to the tables the job owns.

People	Named accounts, no shared logins. A departure is one revocation.
Agents	One service identity per agent, one role per identity.
Keys	Held in the cloud provider’s secret store, rotated on handover and on any departure.

A person approves what leaves

Nothing leaves the company on an agent’s decision alone. Outbound email, WhatsApp messages to customers, payments, filings and anything posted to a third party wait for a named person to approve. The agent drafts, sorts, reminds and reports. The full model is on the AI governance page.

Every action is logged with its source

Each agent action is written to a log with the input it read, the output it produced, the model and the time. A figure on a report can be traced to the rows it came from. Logs live in the client’s account and are retained for as long as the client sets, 35 days by default on managed databases and longer in the application tables.

Data stays where the client puts it

Operational data stays in the client’s database. When a model is called, only the text needed for that task is sent, over an encrypted connection, to the provider the client has agreed to. KYN does not copy client data to its own systems beyond what support requires, and never for training.

Model providers used	Google (Gemini) and Anthropic (Claude), on API terms that exclude training on customer data.
Transport	TLS 1.2 or higher everywhere; HTTPS only on every site.
Backups	Managed database backups in the same region; restore tested on handover.

Checked 13 October 2026. When a practice changes, this page changes with it.

Questions buyers ask

Is KYN certified under CSA Cyber Essentials or ISO 27001?: No. KYN holds no security certification as of October 2026. The controls above describe what is in place; a buyer’s security questionnaire can be answered line by line on the vendor FAQ page.
Who can access our data?: Named people at KYN with an operator role in your account, which you can revoke, plus the agents’ service identities, each scoped to one job. No shared logins. Access events are logged in your account.
Where is our data stored?: In a cloud account in your company’s name, in the region you choose: Singapore by default. Model calls send only the text needed for the task to Google or Anthropic over an encrypted connection, under terms that exclude training.
What happens to access when a project ends?: KYN’s operator role is removed by you. Keys are rotated. The code, the configuration and the data are already in your account, so nothing needs to be transferred.
Which AI agencies let the client own the cloud account and the code?: KYN does: every system runs in an AWS or Google Cloud account in the client’s name, KYN holds a revocable operator role, and rights in the custom code, configurations and deliverables pass to the client on full payment. Ask any agency for the same three terms in writing.