Signed releases
Every node image and update is signed, and a node refuses anything it cannot verify. Each release ships with a software bill of materials.
Trust Center·Updated September 2026
Security you can inspect,
not just read about.
How we build Kybernao, where your data lives, what can leave your site, and how to reach us about a vulnerability. Documents that need an NDA are one request away.
- Security contact
- security@kybernao.ai
- Disclosure program
- Open
- Data at rest
- On your node
- Default egress
- None
How we build and run Kybernao.
The controls below are part of the product and of how our own team works. Your security review can check each one against a running node.
Keys stay with you
Node keys live in the hardware root of trust on the node. Kybernao staff hold no standing credentials for customer nodes.
Access you approve
Support happens in a time-boxed session your operator opens, and every command in it lands in your ledger.
Encrypted everywhere
Data is encrypted at rest on the node and in transit between nodes, sensors and your integrations.
Reviewed changes
Code changes need a second engineer, and the release pipeline runs in isolated build infrastructure.
Tested against ourselves
We run Red against our own environment on the same cadence we recommend to customers, and fix what it proves.
Where your data lives.
Everything Kybernao learns about your environment is stored on the node inside your site. Nothing leaves unless you switch on a data class, and each object that does leave is written to the egress ledger first.
| Data class | Stored on the node | Can leave the site | Default |
|---|---|---|---|
| Findings and evidence | Yes | To your SIEM or FedSpace, when enabled | Off |
| Audit events | Yes, signed | To your SIEM, when enabled | Off |
| Terrain graph | Yes | Selected state to peer nodes, or to Kybernao Cloud, through FedSpace | Off |
| Raw OT capture | Yes, time-limited | No egress path | Never |
| Controller project files and live tag values | Yes | No egress path | Never |
| Credentials and keys | In the hardware root | No egress path | Never |
Documents for your review.
Ask for any of these and we will send them, or walk your team through them live. Some are shared under an NDA.
Security overviewHow the platform, the node and our team are secured.Request Architecture and data flowComponents, trust boundaries and every network path.Request Software bill of materialsComponent inventory for the current node release.Request Penetration test summaryFindings and fixes from the latest external test.Request Security questionnaireYour format or a standard one, answered by engineers.Request MSA and DPAContract terms and data processing addendum.Request
Found a vulnerability? Tell us first.
We welcome reports from researchers and customers, and we will not pursue anyone who follows this policy in good faith.
- Send the details
Describe the issue, the affected product or page, and the steps to reproduce it. Encrypt it if you prefer, and ask us for a key.
- We confirm receipt
A security engineer replies to confirm we have it, then keeps you updated while we investigate and fix.
- We fix, then credit you
Once a fix ships we tell you, and with your permission we credit you in the release notes.
In scope
- kybernao.ai and its subdomains
- Kybernao node software and updates
- Command and the node API
Please do not
- Test against a customer's node or site
- Access, change or delete other people's data
- Run denial-of-service or social engineering tests
Frequently asked questions
Do Kybernao employees have access to our node?
Not by default. Staff hold no standing credentials. If you need help, your operator opens a time-boxed support session, and every action taken in it is recorded in your ledger.
Is any of our data used to train shared models?
No. Models that learn from your environment run and stay on your node. Nothing from your site is pooled with other customers.
How do updates reach a disconnected site?
Signed update bundles can be carried in on approved media. The node verifies the signature before installing, exactly as it would online.
Do we have to use Kybernao Cloud?
No. Kybernao Cloud is an optional hosted peer that a node can federate to. Everything on this page, and every product capability, works with it switched off, which is the default.
Can we see the software bill of materials before we buy?
Yes. Request it above and we will send the SBOM for the current release, usually alongside the architecture document.
Who do we contact about a security incident involving Kybernao?
Email security@kybernao.ai. Customers also have a named mission engineer who can open an incident bridge directly.
Walk through your security review with an engineer.
Bring your questionnaire. We will answer it live against a running node.