Kurahi
Request materialsContact us
EN

Products

All editionsBusinessIndustrialCore
Business: 15 departmentsExecutive office / SecretariatFinance & AccountingAdministration / General AffairsHuman ResourcesPlanning / PMOIT & SecurityProcurementSalesMarketing & CommunicationsCustomer ServiceOperations & LogisticsLegal, Risk & GovernanceProduct, Engineering & R&DFacilities & AssetsQuality & Assurance
CapabilitiesAutopilotSecurity & governanceIntegrationsPricingResources
Request materialsContact us

Security and governance

Built to pass your security review.

Kurahi runs inside your network, under your identity provider, with evidence you can verify. The controls are part of every plan, because security should never be a paid extra.

Contact usRequest materials

Security checklist

ControlFreeEnterprise
Single sign-on: OIDC (Entra ID, Google, Okta, Keycloak) and SAML 2.0
SCIM 2.0 provisioning
Departments, teams and roles
SSO required, with audited break-glass
Attachment quarantine and malware scanning
Signed evidence and hash-chained audit log
Autopilot watchdog and emergency stop
Content-Security-Policy and security headers
Data governance suite—
Deployment without internet access, with local models—

Every security control is included in every plan. Enterprise adds operations at scale.

Your network is the boundary

Kurahi is a service you install and run. Connectors and model providers are off until an administrator turns them on.

Deployment diagram: people, Kurahi, your systems and the models you run sit inside your network boundary; cloud services and external models are outside and reached only through connectors an administrator turns onYour networkOnly what you enablePeopleStaff and approvers signin with your SSOKurahiEditions and work queueAutopilot and policySigned evidence and auditYour systemsFile shares, databases,legacy source codeModels you runLocal or self-hostedCloud servicesMicrosoft 365, kintone,external models: each offuntil configuredconfigured connectors onlyDeployment diagram: people, Kurahi, your systems and the models you run sit inside your network boundary; cloud services and external models are outside and reached only through connectors an administrator turns onYour networkOnly what you enablePeopleStaff and approvers sign in with your SSOKurahiEditions and work queueAutopilot and policySigned evidence and auditYour systemsFile shares,databases, legacysource codeModels you runLocal orself-hostedCloud servicesMicrosoft 365, kintone, external models: eachoff until configured
Fig 1Deployment. Everything outside the boundary is off until an administrator configures it.

Identity under your control

  • Single sign-on

    OIDC with Entra ID, Google, Okta or Keycloak, or SAML 2.0, for everyone who uses the console.

  • SCIM 2.0

    Users and groups are provisioned and removed from your directory.

  • Roles and departments

    Directory groups map to roles, departments and teams, which approval routes and access rules use.

  • SSO required

    Once it is on, token logins of people become an audited break-glass.

Attachments are guilty until scanned

  • Quarantine first

    Every attachment is held in quarantine before anything is stored.

  • Static file policy

    Executables, scripts, macro-enabled Office files and encrypted archives are refused, decided from the bytes, not the file name.

  • Malware scanning

    ClamAV or Microsoft Defender. If the scanner cannot answer, the file is refused.

  • Isolated text extraction

    Text is extracted in isolation, and a refused attachment flags its message for a person.

Agents bounded by policy

  • No dangerous tools in the autopilot model

    The model that plans a routine holds no tools at all, so it cannot send, pay or delete. The engine checks every proposal against the routine's level.

  • Untrusted content is marked as data

    Mail, documents and web pages reach the autopilot model inside marked data blocks. This reduces prompt-injection risk, and that model has no tool to act on an injected instruction.

  • Enterprise package

    A separate package with the consumer-channel plugins omitted; they are refused at runtime even if someone copies them in, and you can verify the package yourself.

  • Policy as code

    Tools, providers, paths and channels are governed by versioned policy files, with a kill switch.

Evidence your auditors can verify

Every autopilot run writes a signed evidence bundle; approvals, flag clearances and configuration changes are in a hash-chained audit log. Evidence holds identifiers and counts, never mail bodies, and verifies offline without the gateway.

For your security review

Report a vulnerability: security@kodasoken.com

Start with one workflow.

Tell us about the work you want to hand over. We will show you Kurahi on your own process, then help you decide how far to take it.

  1. Contact us

    A conversation about the work, the systems involved and who approves what. A demo on a process like yours.

    Contact us

  2. Get a quote

    For digital staff, the data governance suite, air-gapped deployment and SLA support, by written agreement.

    Get a quote

  3. Start free

    Install Kurahi on your own server and run the editions, the work queue and autopilot at L0 and L1 at no charge.

    Start free