Security

Security is central to KyroStat because we run analysis code on data you upload. This page describes the measures we take. We do not claim formal certifications (such as SOC 2 or ISO 27001); we describe here only what we actually do.

Encryption in transit

All traffic between your browser and KyroStat is encrypted with HTTPS (TLS). Authentication tokens are stored in HttpOnly, SameSite cookies so they are not accessible to page scripts.

Account isolation

Each account's projects and data are logically separated. A request can only access the data belonging to the authenticated account that owns it.

Where analysis code runs

AI-generated Python and R runs in your browser where it can, on engines compiled to WebAssembly; your browser downloads the dataset from our servers to do this. When it cannot run there quickly (the in-browser engine has not loaded within a few seconds, your connection is slow, the dataset is too large, or a browser run times out), it runs on our servers in a locked-down, ephemeral container that is created for a single job and destroyed afterwards. Each server sandbox:

• has no network access at all;
• runs as a non-root user with every Linux capability dropped and no privilege escalation;
• uses a read-only root filesystem with only a small temporary work area;
• mounts only that one job's data, read-only;
• is bounded by strict memory, CPU, process, and time limits; and
• runs under a restrictive system-call filter.

What the AI provider receives

Our AI provider is Alibaba Cloud (the Qwen models); when it is unavailable, requests go to the same models through OpenRouter, and only to hosts that do not store or train on prompts. To read your data after upload and recommend tests, it receives a description of your columns: names, types, summary statistics, and for each column with up to 30 different answers, every answer and how many people gave it. To write and fix analysis code it receives no answers, only how they are numbered; when a run fails it sees the code and the kind of error, with any values replaced by placeholders. It never receives your uploaded file or any individual row, and never runs your code. See the Privacy Policy for the full list.

Access and operations

Access to production systems is restricted to the people who operate the Service and is protected by key-based authentication. We keep our dependencies and server software updated.

Your part

Use a strong, unique password, keep your login credentials private, and only upload data you are permitted to use. If you believe your account has been compromised, contact us immediately.

Reporting a vulnerability

We welcome responsible disclosure. If you find a security issue, please email support@kyrostat.com with details and steps to reproduce, and give us a reasonable opportunity to fix it before public disclosure. Please do not access or modify other users' data, degrade the Service, or run automated scans that could disrupt it.