A compliance tool should be easy to trust.
Kmetog connects to your systems and holds your audit evidence, so how it handles access and data matters. Here is plainly what we store, how we connect and where our own compliance posture stands today.
What is stored
Control results, evidence records, remediation tickets, policies and the configuration metadata a check needs. We do not copy full databases or file shares to run a test.
Retention
Evidence is retained for the period your workspace is configured for, to match framework and contractual obligations. On contract end, data is exported to you on request and then deleted.
Connection scope
Each integration requests only the permissions its checks need. Read-only access is used wherever the connected system supports it, and every connection can be revoked by you at any time.
Encryption
Data is encrypted in transit with TLS and at rest with AES-256. Evidence records are sealed with SHA-256 digests so any change is detectable.
Access to your workspace
Role-based permissions within your workspace, with MFA supported for all users. Kmetog staff access is restricted, logged and granted only for support you request.
Activity logging
Test runs, evidence exports, permission changes and ticket updates are logged, so you can see who did what and when.
Our own status, stated as it is.
We apply the same controls we help customers run, and we test and evidence them with Kmetog. We do not display certification badges we have not been awarded. If your vendor review needs our current security documentation, ask during your demo and we will share what is available under NDA.
Security questionnaires from your procurement or vendor risk team are welcome. We answer them directly rather than pointing to marketing claims.
Kmetog automates compliance operations and evidence gathering. It does not replace qualified compliance professionals, legal advice or the formal judgment of your auditor or assessor.
What we handle, and what stays with you
Kmetog is responsible for
- Securing the platform, its infrastructure and stored evidence
- Running tests as configured and recording results accurately
- Keeping framework mappings current as standards change
Your team is responsible for
- Granting connections and deciding which systems are in scope
- Fixing the issues remediation tickets raise
- Final compliance decisions, with your auditor
Bring your vendor review questions.
We will walk your security team through connections, data handling and our current posture in a demo.