Security

Security is foundational to everything we build at kultur.dev. We implement enterprise-grade security controls to protect your data and maintain the integrity of our platform.

Encryption in Transit

All API communications are encrypted using TLS 1.3 with perfect forward secrecy. We enforce HTTPS on all endpoints.

Encryption at Rest

All stored data is encrypted using AES-256 encryption. Encryption keys are managed through secure key management services.

API Key Security

API keys are cryptographically hashed and never stored in plaintext. Keys can be rotated instantly from your dashboard.

Access Controls

Strict role-based access control (RBAC) ensures employees only access systems and data necessary for their role.

Data Handling & Retention

Content Processing Commitment

Content submitted to our API for cultural analysis is processed in memory only and is not persisted to any database or storage system. Your content is never used to train our models or improve our knowledge base.

  • Transient Processing: API query content is processed in real-time and discarded immediately after response generation.
  • Metadata Logging: We retain only request metadata (timestamps, response times, error codes) for 90 days for debugging and analytics.
  • No Model Training: Customer data is never used to train, fine-tune, or improve our AI models or knowledge base.
  • Data Isolation: Each API request is processed in isolation with no cross-contamination between customer data.

Infrastructure Security

Our infrastructure is hosted on enterprise-grade cloud providers with multiple layers of security:

  • Network Security: Virtual private clouds (VPCs) with strict firewall rules, DDoS protection, and intrusion detection/prevention systems (IDS/IPS).
  • Enterprise-Grade Hosting: Infrastructure hosted on cloud providers with industry-leading security certifications and compliance standards.
  • Monitoring: 24/7 infrastructure monitoring with automated alerting for anomalous activities and potential security incidents.
  • Disaster Recovery: Regular automated backups with tested recovery procedures and business continuity planning.

API Authentication

  • Bearer Token Authentication: All API requests require authentication via API keys passed in the Authorization header.
  • Key Hashing: API keys are hashed using bcrypt with appropriate work factors and never stored in plaintext.
  • Instant Revocation: API keys can be revoked immediately from your dashboard if compromised.
  • Rate Limiting: Intelligent rate limiting protects against abuse and ensures fair usage across all customers.

Compliance & Certifications

GDPR Compliant

Compliant

SOC 2 Type II

In Progress

Expected: Q2 2026

ISO 27001

Planned

Expected: Q4 2026

GDPR Compliance: As a Norwegian company, we are fully compliant with the EU General Data Protection Regulation. We act as a data processor when handling customer content and maintain appropriate data processing agreements.

Data Residency: Primary data processing occurs within the European Economic Area (EEA). Enterprise customers can request specific data residency requirements.

Application Security

  • Secure Development: We follow OWASP best practices and conduct regular security code reviews.
  • Dependency Scanning: Automated vulnerability scanning of all dependencies with immediate patching of critical issues.
  • Input Validation: Strict input validation and sanitization to prevent injection attacks.
  • Security Headers: Implementation of security headers including CSP, HSTS, X-Frame-Options, and X-Content-Type-Options.

Responsible Disclosure

We take security vulnerabilities seriously and appreciate responsible disclosure from security researchers and our user community.

Report Security Vulnerabilities

[email protected]

When reporting, please include:

  • • Description of the vulnerability
  • • Steps to reproduce
  • • Potential impact assessment
  • • Any proof-of-concept code (if applicable)

We aim to acknowledge reports within 24 hours and will work with you to understand and address the issue. We do not pursue legal action against security researchers who follow responsible disclosure practices.

Need additional security documentation for procurement?

Contact our security team for compliance documentation and security questionnaires