Trust & Governance

Security & Privacy

KronosX is engineered from the ground up for the strictest healthcare regulatory standards: zero data egress, customer-owned keys, isolated VPC deployment, and mathematical privacy verification.

Contact the security team

Data sovereignty

Zero data egress. Runs in your environment.

KronosX operates entirely inside your security perimeter, so your data estate never has to be copied out to be understood.

Zero External Egress

Customer VPC / On-Premises Architecture

Every data source flows through all three KronosX agents, entirely within your secure customer VPC or on-premises boundary.

Data Sources inside boundary:

Snowflake · BigQuery · Databricks
Epic · FHIR · HL7 · EHR
Documents · APIs · EDI feeds

KronosX Agents inside boundary:

SEALs AI
KNOX
Semantic Twin

Security guarantee: Data never leaves the customer boundary.

Deployed where your data lives
A dedicated AWS, Azure, or GCP virtual private cloud, or your own on-premises data center.
Nothing crosses the boundary
Raw patient records and sensitive clinical files stay inside your network, with no outbound transmission to public LLMs.
Agents come to the data
Discovery, semantic modeling, and privacy intelligence run directly within your environment.

Security posture

Encryption, key isolation, and access control

Even inside your own infrastructure, data stays partitioned and protected against unauthorized access.

Customer-managed keys (BYOK)

Integrates natively with AWS KMS, Azure Key Vault, or HashiCorp Vault. KronosX never holds your master encryption keys.

Encrypted at rest and in transit

AES-256-GCM for data at rest. Mutual TLS 1.3 (mTLS) secures traffic between internal node services.

Role and attribute-based access

RBAC and ABAC tie query permissions to your existing SAML or OAuth2 identities and LDAP directories.

No public LLM egress

Models and agents run inside your boundary. Nothing is sent to a public LLM endpoint.

Partitioned internally

Scoped environments keep each task to the data it needs, even within your own network.

Audit evidence by default

Every query, transformation step, and export produces an audit record you can review.

Regulatory standard

HIPAA Safe Harbor, all 18 categories

KNOX identifies, transforms, and removes the 18 direct and indirect identifiers named by the HIPAA Safe Harbor standard (45 CFR § 164.514(b)(2)).

Direct identifiers (5): Names · Social Security numbers · Medical record numbers · Phone numbers · Email addresses
Geographic identifiers (3): Street addresses · City, county, precinct · Zip codes (first 3 digits kept)
Temporal identifiers (4): Dates of birth · Admission dates · Discharge dates · Dates of death
Biometric and unique identifiers (6): Fingerprints and voiceprints · Full-face photographs · Device identifiers and serial numbers · Web URLs · IP addresses · Vehicle identifiers and license plates

Verifiable compliance

Immutable audit logging and cryptographic receipts

Every query, transformation step, and data export generates an immutable audit record with cryptographic hash verification, ready for compliance reviews.

Audit event	Logged metadata	Supports
Schema discovery scan	Source connection URI, tables inspected, timestamp, discovered columns	Data inventory and classification
KNOX redaction run	Policy ID, transformation rule version, rows processed, SHA-256 output hash	HIPAA § 164.514 verification record
SEALs query execution	User identity, natural-language prompt, generated SQL, joined tables	Logical access monitoring
Governed dataset export	Target VPC, dataset fingerprint, expiration date, cryptographic seal	Enterprise data loss prevention (DLP)

Have specific security or compliance requirements?

Our security architecture team can review your enterprise topology, share security documentation, and discuss custom deployment boundaries.