Start 14-day trial

Trust Center

You hold the keys.
We enforce the rules.

Routing LLM traffic through Kimss does not make us a second model vendor or a key custodian you cannot inspect. Customer provider credentials are envelope-encrypted and client-write-only. The default proxy records metadata and token counts — not prompt archives.

Full architecture Contact sales
Three pillars

Security & Compliance

The same three guarantees we give CISOs, the public security assistant, and developers integrating the vaulted proxy.

Last updated: August 23, 2026

01 · The Vault

Cryptographic isolation

In production, Kimss refuses to store a provider key unless Azure Key Vault wrapping is configured. List/register/rotate never return decrypted keys. Production requires https:// endpoint URLs.

02 · The Payload

Data transience

Default telemetry is correlation IDs, identity claims, tool names, and token counts — including stream_options.include_usage on the BYO hop. Full request/response text is not stored in the compliance pipeline.

03 · Governance

Better than Shadow AI

Hermis enforces Entra-authenticated sessions, a tool allowlist, optional argument-level policies, optional Authority Boundary (sensitive values must carry trusted human provenance — Production+), and a mid-hop kill switch on routed agents. Audit log of administrative actions and governed requests, with configurable retention. Optional APIM GatewayLogs (when enabled) are labeled gateway-verified, never confused with self-reported usage.

Envelope

How the vault wraps a key

Plaintext DEKs exist only in process memory during encrypt and decrypt. The KEK never leaves Azure Key Vault.

1 · DEKRandom 32-byte key per secret
2 · AES-GCMEncrypts the provider API key
3 · RSA-OAEP-256Key Vault wraps the DEK
4 · Postgresenc.v3 blob only

Scope: Connected Infrastructure BYO keys and MCP auth headers. Production endpoint registration requires HTTPS. Optional per-endpoint token caps guard provider spend (separate from governed requests). Kimss SDK keys are hashed. Platform Foundry access uses managed identity — not this vault.

Hermis intercepts MCP tool calls before they reach internal infrastructure. See Security & Compliance for governance details.

Integrations

Secure MCP Integration

Don't expose your internal databases to unmanaged AI. Connect your Model Context Protocol (MCP) servers to the Kimss gateway. We automatically map every internal tool call to a verified SSO identity, enforce Role-Based Access Control (RBAC), and keep an audit log of administrative actions and governed requests, with configurable retention.

Identity

SSO-mapped tool calls

Every MCP tools/call is bound to the signed-in Entra tid/oid before Kimss contacts your server.

Vault

Write-only headers

MCP auth headers use the same enc.v3 envelope as Connected Infrastructure keys. List APIs never return decrypted tokens.

Audit

Audit log

Audit log of administrative actions and governed requests, with configurable retention. Tool executions also land in telemetry.ai_requests as gateway-verified events. Kill switch severs MCP mid-hop; Disable refusals are not Threat Intercepts.

Routing Internal MCP Servers
For reviewers

Send this page to IT

Deep technical detail, client-write-only behavior, and caveats live in developer docs. Public pages do not publish certificate numbers.

Developer whitepaper Compliance architecture security@kimss.ai
FAQ

Questions IT asks first

If we route LLM traffic through Kimss, can you steal our provider keys?
No. In production, Kimss refuses to store a provider key unless Azure Key Vault wrapping is configured. Keys are client-write-only: list, register, and rotate never return decrypted keys. See the whitepaper.
Do you store our prompts and completions?
Default telemetry is metadata and token counts, not full request or response text. Hermis conversation memory and opt-in semantic cache may retain text as product state. When Guardrails PII scrub fires, Threat Intercepts store a sanitized excerpt, not a full prompt archive. Retention follows your plan (Developer 14 / Production 30 / Scale 90 / Enterprise contractual). Kimss does not train foundational models on your prompts.
Can you stop a rogue agent?
For traffic that routes through Kimss or Hermis, disabling the agent is an authoritative kill switch (HTTP 403), including mid-hop. Argument-level tool policies can also soft-fail bad tool parameters so the agent must correct them before execution. Register-only agents that never call Kimss remain inventory until they report or route.
How long are prompts and intercept excerpts retained?
Plan catalog retention: Developer 14 days, Production 30 days, Scale 90 days, Enterprise unlimited (contractual). A daily purge applies those windows to telemetry and Threat Intercept rows. Your order form / DPA wins if it specifies otherwise.
Who at Kimss can access our tenant data?
Production access is limited to authorized Kimss operators under least-privilege Azure RBAC and audited admin paths. Decrypted provider keys are never returned via API or UI. Request deeper evidence packages via Enterprise.
Who are the sub-processors?
Day-to-day infrastructure is Microsoft Azure (App Service, PostgreSQL, Key Vault, API Management, Log Analytics). Billing uses Stripe; transactional email uses SendGrid (Twilio). Your order form / DPA and Privacy Policy are the legal sources for the current list.
Where should IT start a security review?
This page, then the technical whitepaper. Engage Enterprise for deeper evidence packages.