Last updated: September 12, 2026
What “audit-ready” means here
Kimss records product-level attribution—tenants, workspaces, agents, keys, governed requests—so engineering and finance share one vocabulary during reviews.
Kimss keeps an audit log of administrative actions and governed requests, with configurable retention. Optional Azure API Management diagnostics to Log Analytics can add gateway-verified records when enabled and verified. Do not claim gateway telemetry is active in every deployment—see architecture docs and the APIM E2E requirement.
Kimss documents security controls publicly in /docs/security_compliance and /trust. Public pages do not publish certificate numbers.
Controls that support compliance programs
Identity, isolation, retention posture, and change management for agents matter as much as model cards.
- Entra-backed operator identity and workspace RBAC.
- Tenant isolation for data assets and agents.
- governed-request allowances and exhaustion policies as financial controls.
- Public security docs: architecture, compliance, trust & safety.
- Changelog and environment promotion for change evidence.
Honest scope
Kimss does not replace your Azure compliance tooling, DLP, or legal review. It adds the SaaS control plane layer on Foundry.
Read /docs/security_compliance, /docs/trust_safety, and /ai-governance-for-enterprises. Pair Kimss ledgers with Azure Cost Management and Microsoft Purview (or equivalent) as your program requires.
Questionnaire readiness
Point reviewers at public architecture docs first; escalate deeper evidence packages through enterprise channels.
Common questions—prompt retention, subprocessors, isolation model, audit sinks—are addressed in public security documentation. Enterprise customers engage /enterprise for deeper evidence packages.
Frequently asked questions
Where does Kimss keep an audit trail for agent requests?
Kimss keeps an audit log of administrative actions and governed requests, with configurable retention. Optional APIM GatewayLogs add gateway-verified records when enabled—not a prompt archive. See https://kimss.ai/ai-compliance and https://kimss.ai/docs/security_compliance.
Does Kimss store prompts for training?
Kimss is designed with zero prompt retention where that policy applies to your tier. See /docs/trust_safety for guardrail details.
Is Log Analytics always on?
APIM → Log Analytics is optional and environment-specific. Verify before citing it in a customer security packet.
Where are compliance docs?
/trust, /docs/security_compliance, and /docs/security_compliance.
How do we start a compliance review?
Share /docs/why_kimss and security docs, run a staging workspace demo, then engage /enterprise for deeper evidence packages.