Security overview

How KYXO protects your data: tenant isolation, role-based access control, authentication (SSO/MFA), approvals and audit logging.

Estimated time: 4 min · Difficulty: beginner

Overview

Give a high-level, accurate summary of KYXO’s security posture for evaluators.

Anyone evaluating KYXO’s security.

KYXO is built for multi-tenant enterprise use, with security controls at every layer. This overview describes controls that exist in the product today; for a formal security or compliance package (including data-handling and encryption specifics), contact KYXO.

• Tenant isolation — each organization's data is scoped to its tenant; the API gateway

enforces organization boundaries on every request.

• Role-Based Access Control (RBAC) — fine-grained permissions granted through roles, scoped

across organizations, workspaces and projects. See RBAC for delivery platforms.

• Authentication — email/password with a strong password policy, optional single sign-on

(SAML 2.0 / OIDC) and multi-factor authentication (MFA).

• Transport security — application traffic is served over HTTPS/TLS.
• Approval workflows — organizations can require administrator approval for new accounts,

and human approval gates can be required before high-risk actions.

• Auditability — an audit log records create, update and delete actions across entities.

See Maintaining auditability across the SDLC.

• Suspension controls — platform operators can suspend a compromised organization, which

immediately blocks its protected surfaces.

For details on configuring SSO and MFA, see the SSO and Authentication section.