Security
A Decision OS your auditors will love.
Decision data is unusually sensitive. Not because it is rich in personal information, but because it tells a story about how judgement is made inside a company. We treat that story as something to be protected and proven, not mined.
Encryption everywhere
AES-256 at rest. TLS 1.3 in transit. Decision receipts are individually signed and tamper-evident. any change invalidates the certificate.
Least privilege by default
Engineering access to production data is role-gated, time-bound and logged. There is no shared admin account. The founder included.
Isolated tenant data
Each workspace has its own row-level tenancy. No shared models are trained on your data. Your data is never used to improve another customer’s product.
Defensible by design
Every decision the system issues carries a cryptographic receipt. useful for board, audit, regulator, or your own peace of mind six months from now.
Incident transparency
Material incidents are disclosed in writing to affected workspaces within 72 hours. Post-mortems are published, with names redacted, on this site.
SOC 2 controls in progress
SOC 2 Type II controls are in progress. No audit is booked yet — we are pre-revenue and we will not claim a certificate we do not have. We are building the controls a future audit will need, from day one.
Honest, pre-revenue framing
Kauzio was founded in Nottingham in November 2025. We are pre-revenue and we will not pretend to certifications we do not yet hold. What we do have is UK GDPR alignment, a clean architecture, written controls, a dated incident response policy, encryption in transit and at rest, and an audit log for every signed decision.
If you need a vendor security questionnaire completed before you can adopt the product, write to contact and we will turn it around quickly. We would rather be slow on hype and quick on paperwork than the other way round.
Reporting a vulnerability
If you believe you have found a security issue, please email [email protected]. We acknowledge within one working day and aim to triage within 72 hours. We do not currently run a paid bounty programme; we do publicly credit researchers, with consent, in our post-mortems.