Security
Your code is safe with Kiku
Security is not an afterthought at Jishu Labs. Kiku was built with a privacy-first architecture that ensures your intellectual property stays protected. Here's how we safeguard your data.
Encryption Everywhere
All data is encrypted at rest using AES-256 and in transit using TLS 1.3. API keys and secrets are stored in isolated, encrypted vaults with automatic rotation.
On-Premise Deployment
Team and Enterprise plans support full on-premise deployment. Run Kiku entirely within your infrastructure with no external data transmission. Air-gapped environments supported.
Privacy-First Architecture
Kiku processes code locally in your IDE. Only structural metadata (not source code) is transmitted for cloud-assisted features. You control exactly what data leaves your machine.
SOC 2 Type II Certified
Our cloud infrastructure is SOC 2 Type II certified, with annual audits covering security, availability, processing integrity, confidentiality, and privacy.
Regular Penetration Testing
We conduct quarterly penetration tests with independent security firms. Vulnerabilities are triaged within 24 hours and critical issues patched within 48 hours.
Compliance Ready
Kiku meets requirements for GDPR, CCPA, HIPAA (with BAA), and other regulatory frameworks. We provide Data Processing Agreements and security questionnaire responses.
How Code Indexing Works
When you install Kiku, the extension creates a local index of your project on your machine. This index includes file structure, import relationships, type definitions, and pattern fingerprints - but never raw source code.
For cloud-assisted completions (Pro and Team plans), only the relevant context window is sent to our servers, processed in an ephemeral container, and immediately discarded after generating suggestions. We do not train models on your code, store completion inputs, or log code content.
On the Team plan with on-premise deployment, all processing happens within your infrastructure. Zero data leaves your network.
Infrastructure Security
- Cloud infrastructure hosted on AWS with multi-region redundancy
- Network-level isolation using VPCs with no public access to data stores
- Automated vulnerability scanning on every deployment
- 24/7 monitoring with automated alerting for anomalous activity
- Strict role-based access control with MFA required for all employees
- Immutable audit logs for all administrative actions
Responsible Disclosure
We welcome responsible security research. If you discover a vulnerability, please report it to security@jishulabs.com. We commit to acknowledging reports within 24 hours and providing an initial assessment within 72 hours. We do not pursue legal action against researchers acting in good faith.
Security Contact
Email: security@jishulabs.com
PGP Key: Available on request