Kinetry Security Overview

Effective: July 20, 2026

This Security Overview describes how Kalgren Consulting LLC, doing business as Kinetry ("Kinetry," "Company," "we," or "us"), protects the data that Customers and participants entrust to the Kinetry service. It is a companion to our Terms of Service and Privacy Policy and is written for prospective and current Customers who want to understand our security posture before or during use of the Service. It describes controls that are actually in place; it does not create warranties beyond those in our Terms of Service, and where this document and the Terms differ, the Terms control.

Kinetry is an early-access (beta) service. We describe our real controls plainly and do not claim security certifications we do not hold. This is a living document: as the Service matures and our controls evolve, we will update it, and material changes will be communicated as described below and in our Terms.

1. Summary of our approach

Kinetry is a multi-tenant service that collects workplace behavior assessments, computes scores and analytics, and generates AI-assisted coaching content. Our security approach centers on a few principles:

Keep authentication simple and phishing-resistant by removing passwords entirely.
Enforce role- and tenant-scoped access on every data path, so a Customer's data stays isolated to that Customer.
Keep scoring internals and other sensitive processing on the server, never exposed to the browser.
Rely on established infrastructure and payment providers rather than building sensitive components ourselves.
Limit staff access to what is needed to operate, support, and improve the Service.

2. Authentication and sign-in

Passwordless sign-in. Kinetry does not use passwords. To sign in, a user requests a one-time magic link sent to their work email; following the link establishes their session. Because there are no passwords, there are no Kinetry-held password databases to breach and no password reuse risk on our side.
No stored passwords. We do not create, store, or transmit user passwords.
Signed session cookies. After sign-in, the session is carried in an HMAC-SHA256-signed, httpOnly cookie with a built-in expiry. The signature lets the server detect tampering, and the httpOnly flag keeps the cookie out of reach of page scripts.
Single-use, expiring links. Magic links are single-use and expire, which limits the window in which an intercepted link could be misused.
Rate limiting. Requests for magic links are rate-limited to reduce abuse and automated enumeration.
Bot challenge on signup. The signup page is protected by a Cloudflare Turnstile bot challenge.
Read-only demo sessions. Demo sessions are read-only and cannot modify data.

We do not currently offer multi-factor authentication (MFA). The passwordless magic-link model ties each sign-in to control of the user's email inbox.

3. Access control and tenant isolation

Role- and tenant-scoped access on every path. Every data path in the Service enforces access based on the user's role and the workspace (tenant) they belong to. A user cannot reach another Customer's workspace data.
Least privilege. Access — for both Customer users and Kinetry staff — is limited to what a given role needs to do its job. Authorized Kinetry personnel, including Kinetry's principal consultant, may access workspace data to operate, support, and improve the Service and to deliver contracted advisory services, under confidentiality obligations.
"View as" is read-only and recorded. A Customer's own administrators may temporarily view the Service as one of their Authorized Users to provide support and verify access. This "view as" action is read-only and is recorded.
Server-enforced scoring internals. The logic that computes scores and analytics runs only on the server and is never delivered to or exposed in the browser.

4. Data protection

Encryption in transit. Traffic between users and the Service is protected with TLS.
Scoring internals kept server-side. As noted above, sensitive computation stays on the server; clients receive results, not the underlying scoring logic.
Rater confidentiality (360 mode). In multi-rater (360) mode, a Customer never sees another rater's individual responses. Results are computed from combined ratings rather than exposed per rater.
Statistical suppression. In 360 mode, results computed from fewer than the minimum number of raters are suppressed, so an individual rater's input cannot be reverse-engineered from a small sample.
Advisor mode. In single-assessor (advisor) mode, the Customer's designated advisor authors the assessments, so the advisor and the Customer's administrators may access those assessment entries together with the computed results. The identity of the single assessor is known by design in this mode.
Sensitive-data guidance. Customers are prohibited from uploading protected health information or regulated medical records unless separately agreed, and participants are instructed not to submit sensitive categories of personal information. See our Privacy Policy and Terms of Service for details.

5. Infrastructure and hosting

Application hosting. The Kinetry application is hosted on Vercel.
Database. Customer data is stored in a PostgreSQL database hosted on Neon.
Encrypted backups. Database backups are encrypted and age out within about 30 days.
Managed platforms. We rely on these established platform providers for the underlying compute, network, and storage rather than operating our own physical infrastructure.

6. Monitoring and error tracking

Error tracking. We use Sentry to capture application errors so that failures can be found and fixed.
No session replay. Our error tracking does not include session replay.
No default PII capture. Our error tracking is not configured to capture personal information by default.
Service logs. We keep sign-in and usage records (such as timestamps, IP address, and device or browser type) to operate and secure the Service, as described in our Privacy Policy.

7. Payments

Hosted checkout and billing. Payments run through Stripe's hosted Checkout (a redirect) and Stripe's hosted billing portal.
No card data on our systems. Payment card data never touches Kinetry's servers or web pages. We store only Stripe customer and subscription identifiers.
Provider posture. Stripe is a PCI-DSS Level 1 service provider; Kinetry's corresponding posture is SAQ-A, reflecting that card data is fully outsourced to Stripe.

8. Data lifecycle

Customers control the lifecycle of their workspace data, and we provide built-in tools to exercise it. This section summarizes the mechanisms; the Privacy Policy and Terms of Service govern the details.

Export. Workspace administrators can download the workspace's complete data and results at any time, and can export the data for any individual person. Exports respect rater-confidentiality protections — in 360 mode they do not include assessment responses authored by other raters, and a person's own raw self-assessment entries are included only when that person downloads their own export.
Person erasure. Workspace administrators can permanently erase a removed person and the data recorded about them. Erasure is immediate in production systems and cannot be undone. To protect rater confidentiality, past cycles in which the erased person rated others are frozen (their already-published results stand) rather than re-scored from the remaining responses.
Workspace deletion. A Customer can request deletion of its entire workspace by contacting us; we perform it after any active subscription is cancelled.
Residual copies. After erasure, data may persist briefly in encrypted database backups (which age out within about 30 days) and in our error-tracking service (up to 90 days). A minimal record that an erasure occurred is retained for legal purposes.

9. Subprocessors

We use a limited set of vetted subprocessors to operate the Service, each engaged under contract and required to protect data appropriately. Our current subprocessors include:

Neon — database hosting.
Vercel — application hosting.
Stripe — payment processing.
Resend — transactional email delivery (such as sign-in links and service notifications).
OpenAI — AI-generated coaching summaries via the OpenAI API. Kinetry does not use individual responses or confidential information to train large language models or general-purpose AI models, and, per its API terms, OpenAI does not train on this API data.
Sentry — error tracking.
Cloudflare — the Turnstile bot challenge on the signup page.
Plausible — optional, cookieless page analytics, if enabled (currently not enabled in production).

An authoritative, current subprocessor list and the associated contractual commitments are provided through our Data Processing Addendum (DPA). Where this overview and the DPA differ on subprocessor details, the DPA controls.

10. What we do not claim

In the interest of an accurate picture, we are explicit about what we do not have today:

We are not SOC 2 or ISO 27001 certified and do not claim either certification.
We do not publish or represent that we hold a third-party penetration-test attestation.
We do not offer multi-factor authentication (MFA) at this time.
We do not use advertising or marketing trackers, tracking pixels, web beacons, session replay, or a third-party chat widget.

We will update these statements as our controls and certifications change.

11. Incident response and breach notification

No system is perfectly secure. We monitor for errors and abuse, limit access, and rely on established providers to reduce risk. If a security incident affecting Customer data occurs, we will notify affected Customers as required by applicable law, and — where lawful and practicable — provide the information Customers need to meet their own notification obligations. Details of our commitments are set out in our Terms of Service and DPA.

12. Beta status and updates to this overview

Kinetry is an early-access (beta) service, and this Security Overview reflects our posture as of the effective date above. It is a living document. We may revise it to reflect changes in the Service, our infrastructure, our subprocessors, legal requirements, or our practices. Material changes will be communicated in-product, by email, or through other appropriate channels, consistent with our Terms of Service and Privacy Policy.

Security contact: privacy@kinetry.ai (data and privacy) · legal@kinetry.ai (terms and agreements) · Kalgren Consulting LLC (d/b/a Kinetry), Minnesota, USA