Security
1.Overview
This page describes the security controls Kylix Agent has in place today. It is written to be checked, so where something is still being rolled out we say so instead of listing it as done.
2.Encryption
- In transit. Traffic to the website, dashboard, chat widget and APIs uses HTTPS (TLS).
- At rest. Our database and file storage are hosted on Supabase, which encrypts stored data at rest.
- Integration credentials. Credentials for WhatsApp, TikTok Shop, WooCommerce, connected mailboxes and several other integrations are encrypted in the application with AES-256-GCM before they are stored.
- Shopify and Instagram tokens. These are being migrated to the same application-level encryption. Until the migration is complete they are protected by the access controls below but are not yet encrypted at the application layer.
3.Tenant isolation
- Each merchant's data is separated by database row-level security (RLS) policies.
- Privileged database access is used only on our servers and never exposed to the browser.
- Access to production data is limited to people who need it to run the Service.
4.Webhook verification
Incoming webhooks from Shopify, Stripe, Twilio and Meta (WhatsApp and Instagram) are checked against the sender's signature before we act on them. Requests with a missing or invalid signature are rejected.
5.AI processing
To write a reply, the text of the conversation and the merchant's catalog and policy information are sent to our AI provider, Anthropic. The chat widget labels the assistant as an AI so shoppers know who they are talking to.
6.Sub-processors
We use these providers to run the Service. Each receives only the data it needs for its role. The same list appears in our Privacy Policy and Data Processing Addendum.
| Provider | Purpose | Used |
|---|---|---|
| Anthropic | Claude AI models that write the agent's replies | Always |
| Supabase | Database, file storage and sign-in | Always |
| Vercel | Website and application hosting | Always |
| Stripe | Subscription billing and payments | Always |
| Twilio | SMS, WhatsApp and phone calls | When the channel is on |
| Meta | Instagram and WhatsApp messaging | When the channel is on |
| Shopify | Store, order and catalog data | When connected |
| Resend | Transactional and handoff email sent by Kylix | Always |
| ElevenLabs | Voice synthesis for phone calls | When voice is on |
| Klaviyo | Retention sends from the merchant's own flows | When connected |
| Google / Microsoft | Merchant mailboxes connected by OAuth | When connected |
| UpPromote, Seal, Recharge | Affiliate and subscription data | When connected |
7.Data deletion and export
Merchants can ask us to export or delete their data, and end customers can ask for deletion through the brand or directly. We acknowledge requests within 48 hours and complete verified deletions within 30 days. See the Data Deletion Instructions.
8.Certifications
Kylix Agent does not currently hold a SOC 2 report or ISO 27001 certification, and it is not designed for regulated health data (HIPAA). If you need a security questionnaire answered, email us and we will answer it directly.
9.Reporting a security issue
If you believe you have found a vulnerability, email hello@kylixagent.com with “Security” in the subject line. Please give us reasonable time to fix the issue before sharing it publicly, and do not access data that is not yours.