Trust Center
Trust Center
What Kurahi does with your data and your systems, stated from its documentation. Every statement below links to the document it comes from; nothing here goes beyond those documents.
Last reviewed: 25 October 2026, Kurahi 2.2.0.
Deployment model
Kurahi is self-hosted software. The gateway runs on your own machine or server under the operating system's service manager; there is no Kurahi-operated cloud component in the evaluation configuration.
Source:Security overview
You choose where models run: on the same machine, with a Japan-hosted model service (the default profile), with an external provider, or air-gapped (licensed separately).
No telemetry, analytics, crash reporting or usage statistics are sent. The gateway does not contact Kurahi or its vendor at runtime.
Source:Privacy statement · Security overview
Data handling and data flows
All state lives in one directory you control. Nothing is written elsewhere except the program files.
Source:Security overview
Only these flows can leave the machine: model requests to the provider you configure, messages on channels you enable, a version-only update check, a local network announcement and the installer download. Each one has an off switch.
Source:Privacy statement
Sessions and transcripts are kept until you delete them, logs rotate daily, and the audit chain is kept in monthly files. One command removes everything.
Source:Security overview
Secrets are stored in protected files or the encrypted secrets store, are never printed or accepted on the command line, and are redacted from logs.
Source:Security overview
Security architecture
Policy as code: one signed policy per gateway governs tools, providers, models, channels, paths and budgets. In enforce mode an unsigned or altered policy is refused, and every decision is written to the audit log with the clause that decided it.
Source:Policy as code · Security overview
Approvals and kill switch: tool classes can require a human approval, in the terminal or over a chat channel, with waits bounded by the policy timeout. One command stops every agent.
Network: the gateway listens on loopback by default. Remote access is an explicit setting, and every API route except health requires a credential.
Source:Security overview
Enterprise identity: people sign in with the organisation's identity provider over OIDC or SAML 2.0, are provisioned with SCIM 2.0 and hold roles within departments and teams. Off by default, and included in every plan, Free included. When SSO is required, the gateway token works only as an audited break-glass login.
Credential isolation: with explicit isolation, an agent sees only the credential profiles granted to it, and nothing is copied or merged from the main agent.
External agent adapters: a published compatibility contract states, for each adapter, which restrictions are enforced before the external agent runs, which are only detected afterwards, and which are not controlled.
Source:External agent adapters
Context guard: personal data in tool results is replaced with placeholders before the model sees it. Limits: images are not inspected, and the detectors are patterns.
Source:Context guard
Required snapshots: an edit to a file you mark as protected is refused when its recovery snapshot cannot be captured. Edits inside the sandbox are not covered.
Boot integrity gate: protected policy files are hashed at install and re-checked on every start; in enforce mode a changed file stops the gateway from booting.
Source:Integrity and audit
Attachment intake: mail attachments are quarantined, checked by a static file policy and scanned with ClamAV or Microsoft Defender before a Project stores them. The scan fails closed: a timeout, a crash or a missing verdict is never treated as clean. Unknown (zero-day) malware can still pass a scanner.
Enterprise package: consumer-channel plugins are omitted from the enterprise package and refused at runtime, with an audit entry, even if someone copies them in. Some consumer-channel code remains in the core, inert: it runs only when its channel plugin registers it.
Untrusted content: web pages, remote agents and business connector results reach the model inside untrusted-content markers. The markers reduce prompt-injection risk; they do not prevent it. Messages from channel users and MCP results are not wrapped.
Source:OWASP Agentic Top 10
Evidence and audit
Every job can be exported as a signed, hash-chained evidence bundle that an auditor verifies offline, without the gateway, using kurahi evidence verify.
Source:Evidence bundles
Autopilot: the model that reasons for a routine has no tools. The engine executes only what the routine's autonomy level allows, and acting externally needs a person's standing approval. Every run writes a signed evidence bundle; signed evidence establishes the integrity and provenance of the record, not that a decision was correct.
Source:Autopilot
Authentication, pairing, administrative actions and tool executions are appended to a hash-chained audit log. Tampering is detectable, not preventable, unless the files are shipped to write-once storage.
Source:Security overview
AI inventory
kurahi inventory lists every agent with its models, tools, policy rules, MCP servers, channels and evidence, and exports it as a signed file or a spreadsheet. An edited inventory fails verification.
Source:AI inventory
Ransomware detection
Decoy files and mass-encryption detection stop every agent and record the incident in the audit log. This is detection, not complete protection: files encrypted before a signal fires are damaged, it stops agents rather than the malware, and it keeps no off-machine copies. Keep your backups.
Source:Ransomware detection (shield) · Capabilities in this release
Build integrity
Builds are not yet code-signed or notarised.
Source:Capabilities in this release
Each release publishes SHA256SUMS.txt, and the installers refuse a download that does not match it. A CycloneDX SBOM and a build provenance attestation, verifiable with gh attestation verify, are published with every release. Dependencies are pinned, and CI runs a secret scanner.
Source:Security overview · Packaging and releases
Vulnerability disclosure
Report vulnerabilities privately to security@kodasoken.com. Targets: acknowledgement within 3 working days, triage within 10 working days, a fix or mitigation for confirmed high or critical issues within 30 days, and coordinated disclosure at most 90 days after the report.
Source:SECURITY.md · Security overview
Certifications
No third-party certification yet. ISO/IEC 27001 and SOC 2 are not held.
A self-assessment by the KODA SōKEN team against the OWASP Top 10 for Agentic Applications rates 4 risks addressed and 6 partly addressed. It is not a certification or a third-party audit.
Source:OWASP Agentic Top 10
Downloads
For procurement and security reviews.
- Kurahi Security Overview & Questionnaire Responses v1
About 60 standard questions, each answer citing its source document. English and Japanese.
- Evaluation licence
Currently a draft pending legal review.
In the product
Controls that show up on the screen
The governance described on this page, as people see it in the Kurahi console, shown with sample data.
Policy checks that stop
A failed blocking check — here, a suspected bank-change fraud — stops approval and records the policy version that decided it.
Decisions only people make
Required approvers and separation of duties on every route; agents cannot approve.
Autonomy under human control
Levels change only by a person's decision on evidence; the watchdog can only lower them.
Evidence for every run
Each run records what was read, what the model proposed and each decision, verifiable offline.
