Security
Security architecture
How we build and operate secure industrial AI systems. From web interface controls to edge deployment architecture and AI authority bounds.
AI System Security
Industrial AI safety controls
Authority-Bounded
Every decision operates within configured authority limits
Trust-Stratified
Signals are weighted by verified source reliability
Full Auditability
Every inference and action is logged and explainable
Edge-First
Sensitive data processed on-premises or at the edge
Fail-Safe Design
Graceful degradation preserves safety in failure states
OWASP Aligned
Web interfaces built to OWASP ASVS security standards
Edge-Only Data Processing
Production data is processed on-premise. No industrial telemetry is sent to cloud infrastructure without explicit operator configuration.
Air-Gap Support
VisionOS and BrainOS can operate in fully air-gapped environments with no external network connectivity.
Authority-Bounded Operations
Every action BrainOS can take is explicitly enumerated at deployment time. The system cannot expand its own authority at runtime.
Immutable Audit Logs
Every inference, decision, and escalation is logged with a tamper-evident audit trail. Exportable for compliance investigations.
Principle of Least Privilege
Each system component holds the minimum permissions required. Components cannot access resources outside their defined scope.
Fail-Safe Defaults
In degraded or uncertain states, safety-critical functions default to safe states rather than attempting to recover autonomously.
Web Interface Security
Application security controls
Web interfaces are built to OWASP ASVS standards. The OWASP Top 10 risks are addressed in our development process.
| Control | Implementation |
|---|---|
| Content Security Policy (CSP) | Strict CSP preventing XSS and code injection. Only whitelisted sources for scripts, styles, images, and connections. |
| HTTPS / HSTS | All interfaces served over HTTPS only. HSTS with preload enforced across all subdomains. |
| Input Validation | All user inputs validated server-side using strict schemas (Zod). Length limits, type checks, and format validation on every field. |
| Rate Limiting | Contact and API endpoints rate-limited per IP. Repeated abuse results in temporary blocks. |
| Anti-Spam / Bot Protection | Honeypot fields and server-side heuristics protect contact forms from automated abuse. |
| No Secrets in Frontend | All API keys, tokens, and credentials are server-side only. Environment variables, not embedded constants. |
| Secure Headers | X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy configured on all responses. |
| CSRF Protection | API routes validate Content-Type and origin. Sensitive mutations require authenticated sessions. |
| Error Handling | Error responses never leak stack traces or internal state. Structured error codes only. |
| Dependency Audit | Dependencies scanned with npm audit on every build. Automated alerts for new high/critical CVEs. |
Responsible disclosure
If you discover a security vulnerability in our systems or interfaces, please report it responsibly to security@krinisai.com. We commit to acknowledging reports within 48 hours and disclosing resolved issues within 90 days.
We ask that you do not access production data, attempt denial-of-service, or disclose findings publicly before we have had a reasonable opportunity to resolve them.