Security at Kyomi
Security isn't just a feature—it's foundational to everything we build. This page explains our security practices in detail.
Our Security Philosophy
Privacy by design: We built Kyomi to minimize BigQuery data storage. We cache table/column metadata for search, but your actual data rows stay in your warehouse. Query results stream through our infrastructure but aren't stored (except limited 20-row samples in AI chat history).
Defense in depth: Multiple layers of security protect your account, data, and infrastructure.
Transparency: We're open about our security practices so you can make informed decisions.
Data Security
Your BigQuery Data
The most important point: We minimize BigQuery data storage and use encryption when we do store it.
What we cache: Table and column metadata (names, types, descriptions) to enable intelligent search. This metadata is workspace-isolated.
What we don't cache: Your actual data rows. Query results are handled differently depending on the mode (see below).
Kyomi has three data access modes with different security implications:
Mode 1: AI Agent Queries (Server-Side, Limited)
- 20-row limit - AI queries are restricted to maximum 20 rows
- Server-side analysis - Results sent to our backend for AI analysis
- Encrypted storage - 20-row samples stored encrypted at rest with AES-256-GCM (for chat history display)
- Workspace-isolated - Only you can access your chat data
- User-deletable - Delete chat history anytime
Mode 2: Standard Dashboard Access (Default, Most Secure)
- Direct to browser - Results stream directly from BigQuery API to your browser
- Bypasses our servers - Data never touches our infrastructure
- Client-side processing - DuckDB WASM processes data in your browser
- No storage - Query results aren't stored by us
This is the default mode for dashboards and SQL editor.
Mode 3: Arrow Streaming (Opt-In, Faster)
- Optional checkbox - You choose to enable this for faster downloads
- Through our server - Data passes through backend (20-100x faster)
- In-memory only - Data never written to disk on our servers
- No storage - Data immediately discarded after streaming
Result: Even if our servers were compromised:
- Mode 1 (AI Agent): Only encrypted 20-row samples exposed (not full datasets)
- Mode 2 (Standard): Zero BigQuery data exposed (bypasses our servers)
- Mode 3 (Arrow): Zero BigQuery data exposed (in-memory only, no persistence)
Application Data
Data we do store (chat messages, dashboards, queries, catalog metadata) is protected with:
Encryption
- In transit - TLS 1.3 for all connections
- At rest - AES-256-GCM authenticated encryption for:
- Chat message content (AI responses, summaries)
- Chat message metadata (20-row data samples)
- OAuth tokens (Google access/refresh tokens)
- Backups - Encrypted backups in Google Cloud Storage
BigQuery Catalog Metadata
We cache metadata about your BigQuery datasets to enable intelligent search:
What we store:
- Table names, descriptions, and schema structure
- Column names, data types, and descriptions
- Modified timestamps for incremental indexing
What we DON'T store:
- Actual data rows from your tables
- Query results (except 20-row samples in AI chat history)
How it's protected:
- ✅ Stored in PostgreSQL database
- ✅ Workspace-isolated (only your team can access)
- ✅ Used only for search functionality
- ✅ Incremental updates minimize data transfer
Why we cache it: Enables semantic search across thousands of tables, helping you quickly find relevant datasets without querying BigQuery repeatedly.
Access Controls
- Multi-tenant isolation - Workspace data is strictly isolated
- Role-based access - Users only see what they're authorized to see
- API authentication - OAuth 2.0 with short-lived access tokens
- Session management - Secure HTTP-only cookies
Data Retention
- Active data - Kept while your account is active
- Deleted data - Permanently deleted within 30 days
- Backups - Retained for 30 days, then permanently deleted
- Logs - Security logs kept for 90 days
Authentication & Access
Authentication Method
We use Google OAuth for secure, passwordless authentication:
Google OAuth
- Industry-standard OAuth 2.0 flow
- No passwords to manage
- Leverages Google's security infrastructure
- Two-factor authentication via your Google account
Session Security
- Short-lived tokens - Access tokens expire automatically
- Refresh tokens - Securely stored and rotated
- Automatic logout - Sessions expire after period of inactivity
- HTTP-only cookies - Protected from XSS attacks
Infrastructure Security
Infrastructure Hosting
- Infrastructure - Secure dedicated servers with encrypted storage
- Network - VPC isolation, private subnets
- Firewalls - Strict ingress/egress rules
- Physical security - Secure data center with controlled access
Application Security
Code Security
- Dependency scanning - Automated vulnerability detection
- Static analysis - CodeQL security analysis
- Secret scanning - No credentials in code
- Security updates - Patched within 48 hours of disclosure
Runtime Security
- Container isolation - Docker containers with minimal attack surface
- Least privilege - Services run with minimum necessary permissions
- Security headers - CSP, HSTS, X-Frame-Options, etc.
- Rate limiting - Protection against brute force and DoS
API Security
- Input validation - All inputs sanitized and validated
- SQL injection prevention - Parameterized queries only
- XSS protection - Content Security Policy, output encoding
- CSRF protection - Token-based validation
Monitoring & Detection
- Security monitoring - 24/7 automated threat detection
- Intrusion detection - Anomaly detection and alerting
- Error tracking - Sentry for error monitoring
- Audit logs - All sensitive operations logged
- Uptime monitoring - UptimeRobot checks every 5 minutes
Third-Party Security
We carefully vet all third-party services:
Critical Services
| Service | Purpose | Security Features |
|---|---|---|
| Google BigQuery | Your data warehouse | SOC 2, ISO 27001, GDPR compliant |
| Google OAuth | Authentication | Industry-standard OAuth 2.0 |
| Stripe | Payment processing | PCI DSS Level 1, we never see card numbers |
Data Processing Agreements
We have DPAs in place with all services that process customer data, ensuring:
- GDPR compliance
- Data protection requirements
- Incident notification procedures
- Secure data handling practices
Security Best Practices for Users
For Workspace Owners
- ✅ Enable 2FA on your Google account - Protect your Kyomi access
- ✅ Review workspace members - Remove users who no longer need access
- ✅ Monitor usage - Check for suspicious activity
- ✅ Keep contact info current - So we can reach you about security issues
For All Users
- ✅ Don't share credentials - Each team member should have their own account
- ✅ Log out on shared computers - Or use private browsing
- ✅ Report suspicious activity - Email security@kyomi.ai
- ✅ Keep your browser updated - For the latest security patches
- ✅ Be cautious with dashboard sharing - Understand who can see shared dashboards
For BigQuery Security
- ✅ Use least-privilege IAM - Grant Kyomi only necessary permissions
- ✅ Enable audit logging - Track all BigQuery access
- ✅ Monitor costs - Detect unusual query patterns
- ✅ Restrict by IP - Use VPC Service Controls if needed
Incident Response
If You Suspect a Security Issue
Act quickly:
- Email us immediately - security@kyomi.ai
- Include details - What you observed, when, any evidence
- Don't publicly disclose - Give us time to fix it first
We'll respond within 24 hours (usually much faster)
Our Incident Response Process
If we detect a security incident:
- Contain - Stop the threat immediately
- Investigate - Understand scope and impact
- Notify - Inform affected users within 72 hours
- Remediate - Fix the vulnerability
- Post-mortem - Learn and improve
What You'll Receive
- Transparent communication - We'll tell you what happened
- Timeline - When it occurred, when we detected it
- Impact assessment - What data (if any) was affected
- Remediation steps - What we're doing to fix it
- Prevention - How we're preventing it from happening again
Vulnerability Disclosure
Responsible Disclosure
We welcome security researchers to help us stay secure:
- Report vulnerabilities - security@kyomi.ai
- Give us time to fix - 90 days before public disclosure
- Don't exploit - Don't access user data or disrupt service
- Act in good faith - We won't take legal action against responsible disclosures
Bug Bounty Program
Currently, we don't have a formal bug bounty program, but we:
- Acknowledge all valid reports
- Fix vulnerabilities promptly
- Credit researchers (with permission) in our security updates
- Provide public thanks for significant findings
Interested in a formal bug bounty? Email us—we're considering it for the future.
Compliance & Certifications
Current Status
- GDPR - Compliant with EU data protection regulations
- CCPA - Compliant with California privacy laws
- SOC 2 - Planned for when we have enterprise customers requiring it
- ISO 27001 - Under consideration for global certification
Privacy Regulations
We apply EU-level data protection to all users:
- Data minimization - Collect only what's necessary
- Purpose limitation - Use data only for stated purposes
- Storage limitation - Retain only as long as needed
- Integrity & confidentiality - Appropriate security measures
Security Updates
We publish security updates when appropriate:
- Security advisories - For vulnerabilities affecting users
- Changelog - For security-related feature updates
- Blog posts - For major security improvements
Subscribe to updates: Blog or follow our changelog
Questions About Security?
We're happy to discuss our security practices:
- General questions - security@kyomi.ai
- Vulnerability reports - security@kyomi.ai
- Enterprise inquiries - enterprise@kyomi.ai
Response time: 24 hours for security issues, 2 business days for general questions
Security is a Journey
Security isn't a destination—it's an ongoing commitment. We continuously:
- Monitor threats and vulnerabilities
- Update our security practices
- Educate our team
- Listen to our users
- Invest in security infrastructure
Your trust is our most valuable asset. We take that responsibility seriously.
Last updated: November 16, 2025
For our Privacy Policy, see kyomi.ai/privacy