Where data lives
Hosted with Microsoft Azure in United States regions, in a production environment kept separate from development and testing. Data never leaves the United States.
Verified September 2026Security and data handling
Built for records that carry participant information.
KinComply holds participant records under government contracts, so the controls below are not plans. Each one is in place today and has been verified against the live service; the note on each card says when it was last checked.
Nothing here is claimed ahead of the evidence. The detailed control list, and anything still in progress, is shared under agreement rather than published.
The controls
What protects the record, and when it was last checked.
Encryption
Encrypted in transit and at rest, including backups. Connections that cannot be encrypted are refused.
Verified September 2026Program isolation
Each organization’s records are isolated at the database layer, not only in the application. A user of one program cannot reach another’s records by any path.
Verified July 2026Who can see what
Program staff sign in with single sign-on and multi-factor authentication. Employers and participants never get accounts: they respond through time-limited, single-use links that carry no personal information.
In place since launchAudit trail
Every record change, verification and report run is written to an append-only, tamper-evident log. The log cannot be edited or deleted, by anyone.
Verified July 2026Reproducible reports
Each generated report is frozen with a cryptographic fingerprint and the data behind it, and is checked against that fingerprint before it is shown again.
In place since launchBackups and recovery
Continuous backups with retention set to the contract’s five-year records requirement. Recovery is rehearsed against production, not assumed, and the recovery objectives are documented.
Restore rehearsed September 2026Retention and return
Records are kept for five years past final payment. At the end of a contract the program’s data is returned to the agency, not deleted and certified.
Contract commitmentIncident response
A written response plan with pre-drafted notices, rehearsed as a tabletop exercise. Notices to individuals are directed by the funding agency.
Rehearsed August 2026Secure development
Automated scanning of code and dependencies on every change. Data arriving from partner systems is validated before it is used.
Verified July 2026Participant data, minimized
Records hold the least identifying information the program needs, and no participant data appears in any link, page title or hover text.
Design rule since launchYour questionnaire
A completed security questionnaire, the control mapping for your data-sharing agreement and the evidence behind each item above are shared under agreement with any evaluating agency or institution.
On requestHow this page is kept honest
Reviewed with every security release.
Each control above is tied to a dated verification against the live service. The complete control inventory, including items still in progress, is detailed rather than summarized here, and we share it under agreement with evaluating agencies and institutions instead of publishing it, so that it informs a security review without informing anyone else.
Questions: info@kintechnetwork.com.
Next step
Send us your security questionnaire.
We answer it from the evidence above, and walk your team through any control on a call.
Evidence. Outcomes. Confidence.