K3nzoAI
Back to k3nzoai.com

Security

Security & Responsible AI

Last updated: June 29, 2026

This page describes the security measures currently implemented in Kenzo AI, based on direct review of the codebase. We list only measures we have actually built — not aspirational claims.

Security overview

HTTPS everywhere

All data between your browser and our servers is encrypted in transit via TLS. We do not serve any content over unencrypted HTTP.

HttpOnly session cookies

Authentication session tokens are stored in HttpOnly cookies — they cannot be read or stolen by client-side JavaScript, protecting against common XSS attacks.

No plaintext passwords

Passwords are hashed by Supabase Auth using industry-standard algorithms. We never store or transmit your password in plaintext.

Current password verification

Changing your password requires verifying your current password first. The server re-authenticates before allowing a password change.

Email enumeration prevention

The forgot-password flow always returns the same response regardless of whether the email exists in our system, preventing enumeration attacks.

Input validation

All form inputs are validated client-side using Zod schemas before submission. Server-side actions apply the same validation rules.

Authentication

Kenzo AI uses Supabase Auth for all authentication operations. The supported authentication methods are:

  • Email and password (with email confirmation on signup)
  • Password reset via emailed link

Social login (Google, GitHub, etc.) and multi-factor authentication (MFA) are not currently enabled.

Data storage and access

All platform data (assets, employees, locations, maintenance logs) is stored in a PostgreSQL database hosted by Supabase. Supabase runs on Amazon Web Services (AWS).

All user data queries use the Supabase anonymous key with an authenticated session, so Row Level Security (RLS) is enforced at the database level. Every table has explicit per-organization RLS policies — SELECT, INSERT, UPDATE, and DELETE are all scoped to the authenticated user's organization. A service role key is used only for privileged internal operations and is never exposed to browser clients.

Responsible AI

The AI assistant in Kenzo AI is built with the following safeguards:

  • Read-only typed tools — the AI selects from a fixed set of named tool functions. There is no SQL generation; arbitrary queries are architecturally impossible. Each tool runs a parameterised Supabase query scoped to the authenticated organization.
  • No background data access — the AI only processes data when you actively send a message. There is no continuous monitoring.
  • Private saved history — Kenzo AI stores your chat messages and assistant responses in its database as saved conversation history. Saved conversations are scoped to your signed-in user and organization and are not shown to other members of your organization.
  • Transparent disclosure — this page and the AI Usage Policy document exactly what data is shared with Anthropic and when.

What we have not yet built

In the spirit of transparency, the following security improvements are identified but not yet implemented:

  • Multi-factor authentication (MFA)
  • Automated security scanning in CI/CD
  • Formal security audit or penetration test

These are roadmap items. We will update this page as each is implemented.

Reporting a security vulnerability

If you discover a security vulnerability in Kenzo AI, please report it responsibly. We ask that you:

  • Do not exploit the vulnerability or access data beyond what is needed to verify it
  • Do not publicly disclose the issue before we have had a chance to address it
  • Provide sufficient detail to allow us to reproduce and fix the issue

Report security issues to: security@k3nzoai.com

We aim to acknowledge receipt within 48 hours and to provide an initial assessment within 7 business days.

Third-party security

Our primary service providers maintain their own security programs: