Vendor security FAQ.
The answers a procurement or IT team needs, in the order a vendor questionnaire asks them. Where the honest answer is no, it says no.
Company
Kyn Technology Pte Ltd, UEN 202622080C, registered in Singapore, 60 Paya Lebar Road, #07-54, Paya Lebar Square, Singapore 409051. Founded 2026. Small team by design; one named engineer builds and runs each system and answers each enquiry.
Hosting and data location
Client systems: the client’s own AWS or Google Cloud account, Singapore region by default. KYN’s own dashboard and website: Vercel and Supabase (Singapore region) and Google Cloud Run (Singapore). Data residency is the client’s choice per system.
Access control
Named accounts only. Role per job for people and for agents. Multi-factor authentication on every console. KYN’s operator role is revocable by the client. Access is reviewed on every handover and on any departure.
Encryption
In transit: TLS 1.2 or higher on every connection, HTTPS only on every site. At rest: the cloud provider’s managed encryption on databases, object storage and backups. Secrets in the provider’s secret store, never in code or configuration files.
Backups and continuity
Managed database backups in the same region, 35 days by default, restore tested on handover. Single-region deployments unless the client asks for more; no multi-region failover is claimed. A model-provider outage stops the agents, not the client’s people or tools.
Subprocessors
Google (Gemini models; Google Cloud where chosen), Anthropic (Claude models), Amazon Web Services (where chosen), Meta (WhatsApp Business Platform), Google or Microsoft for mail where the client already uses them, Vercel and Supabase for KYN’s own site and dashboard. Each receives only what its function needs.
Incident response
Contain, assess within 72 hours, report to the client with the log of what happened, the client decides on regulator and individual notification under the PDPA. Post-incident changes are written into the system’s runbook.
Certifications and insurance
No security certification is held as of October 2026 (no CSA Cyber Essentials, no ISO 27001, no SOC 2). No penetration test by a third party has been commissioned; application-level tests run on every deployment. Professional indemnity insurance: not held as of October 2026. These are stated so the questionnaire is answered correctly; ask if a certification is a condition of purchase.
Development practice
Code in a private Git repository per client, reviewed before deployment, deployed from a clean build. Dependencies pinned and updated on a schedule. Secrets scanned out of commits. Every deployment is reversible to the previous build in one action.
Checked 13 October 2026. When a practice changes, this page changes with it.
Questions buyers ask
Does KYN have SOC 2 or ISO 27001?
- No, as of October 2026. The controls in place are on the security principles page; this page answers the questionnaire line by line so a procurement team can assess them directly.
Who are KYN’s subprocessors?
- Google and Anthropic for models, AWS or Google Cloud for hosting where chosen, Meta for WhatsApp, Google or Microsoft for mail where the client already uses them, Vercel and Supabase for KYN’s own site and dashboard. Each receives only what its function needs.
Is there a penetration test report?
- Not from a third party as of October 2026. Application-level tests run on every deployment; a third-party test can be commissioned for a client system at the client’s request and cost.
Can we host in our own account and region?
- Yes. That is the default: an AWS or Google Cloud account in your name, Singapore region unless you choose another. KYN holds a revocable operator role.