Built for the most
sensitive deals
M&A data is among the most sensitive information your organization handles. Kairos was architected from day one for deal confidentiality — not retrofitted with a compliance checkbox.
Six layers of protection
Security at Kairos isn't a feature — it's the foundation. Each layer is designed to protect deal confidentiality from infrastructure to application level.
SOC 2 Type II Certified
Independently audited against the Trust Services Criteria. Our SOC 2 Type II report covers security, availability, processing integrity, confidentiality, and privacy — available to customers under NDA.
Encryption Everywhere
AES-256 encryption at rest. TLS 1.3 in transit. Encryption keys are per-tenant, rotated regularly, and never shared across organizations. Sensitive fields are additionally encrypted at the application layer.
Strict Tenant Isolation
Each customer's deal data lives in a completely isolated environment. There is no shared database table, no shared storage bucket, and no shared compute between tenants. Your pipeline is invisible to every other organization.
Zero Data Training Policy
Your deal data — targets, memos, financials, diligence documents — never trains AI models. The AI features in Kairos run on foundation models and your data as context, not as training input. Full stop.
Full Audit Trail
Every action in Kairos is logged: who accessed what, when, from where, and what changed. Audit logs are immutable, retained for 7 years, and exportable for compliance reviews. Complete chain of custody on every deal.
Access Controls
Role-based access controls (RBAC), SSO/SAML integration (Firm plan), and multi-factor authentication. Granular deal-level permissions — restrict specific deals to specific team members or external advisors.
Enterprise infrastructure, built in
Hosting & Network
Application Security
Data Handling
Compliance & Governance
What happens if something goes wrong
Despite best efforts, no system is perfectly immune. What matters is how quickly and transparently we respond.
- < 1 hour Initial response to P0/P1 security incidents
- < 4 hours Affected customers notified of confirmed breach
- < 72 hours Regulatory notification where required
- < 30 days Full post-incident report shared with affected customers
Reliability you can count on
Uptime SLA (Firm plan)
Backed by financial credits if missed
Uptime SLA (Deal Team)
Monitored 24/7
API response time target
p95 at standard load
Automated backups
Point-in-time recovery available
Your deal data is yours. Always.
M&A deals represent some of the most commercially sensitive information in business. The targets you're evaluating, the prices you're willing to pay, the weaknesses you've identified in diligence — this is information that competitors, targets, and counterparties would pay dearly to access.
We take this seriously in a way that legacy enterprise platforms with general-purpose architectures simply cannot. Every design decision in Kairos — from our data model to our AI implementation to our employee access controls — starts with the question: "Does this protect deal confidentiality?"
Three non-negotiables that will never change at Kairos:
- 1. Your deal data will never be used to train AI models — ours or anyone else's.
- 2. Your data will never be shared with, visible to, or accessible by any other Kairos customer.
- 3. You can export or delete your data at any time, completely and permanently.
Security questions?
Our security documentation — including our SOC 2 report, penetration test summary, and vendor assessment questionnaire — is available to qualified prospects under NDA.
For vulnerability disclosures, please email security@kairosdeals.com with details. We respond within 24 hours.