Security and governance
Built to pass your security review.
Kurahi runs inside your network, under your identity provider, with evidence you can verify. The controls are part of every plan, because security should never be a paid extra.
Security checklist
| Control | Free | Enterprise |
|---|---|---|
| Single sign-on: OIDC (Entra ID, Google, Okta, Keycloak) and SAML 2.0 | ||
| SCIM 2.0 provisioning | ||
| Departments, teams and roles | ||
| SSO required, with audited break-glass | ||
| Attachment quarantine and malware scanning | ||
| Signed evidence and hash-chained audit log | ||
| Autopilot watchdog and emergency stop | ||
| Content-Security-Policy and security headers | ||
| Data governance suite | — | |
| Deployment without internet access, with local models | — |
Every security control is included in every plan. Enterprise adds operations at scale.
Your network is the boundary
Kurahi is a service you install and run. Connectors and model providers are off until an administrator turns them on.
Identity under your control
Single sign-on
OIDC with Entra ID, Google, Okta or Keycloak, or SAML 2.0, for everyone who uses the console.
SCIM 2.0
Users and groups are provisioned and removed from your directory.
Roles and departments
Directory groups map to roles, departments and teams, which approval routes and access rules use.
SSO required
Once it is on, token logins of people become an audited break-glass.
Attachments are guilty until scanned
Quarantine first
Every attachment is held in quarantine before anything is stored.
Static file policy
Executables, scripts, macro-enabled Office files and encrypted archives are refused, decided from the bytes, not the file name.
Malware scanning
ClamAV or Microsoft Defender. If the scanner cannot answer, the file is refused.
Isolated text extraction
Text is extracted in isolation, and a refused attachment flags its message for a person.
Agents bounded by policy
No dangerous tools in the autopilot model
The model that plans a routine holds no tools at all, so it cannot send, pay or delete. The engine checks every proposal against the routine's level.
Untrusted content is marked as data
Mail, documents and web pages reach the autopilot model inside marked data blocks. This reduces prompt-injection risk, and that model has no tool to act on an injected instruction.
Enterprise package
A separate package with the consumer-channel plugins omitted; they are refused at runtime even if someone copies them in, and you can verify the package yourself.
Policy as code
Tools, providers, paths and channels are governed by versioned policy files, with a kill switch.
Evidence your auditors can verify
Every autopilot run writes a signed evidence bundle; approvals, flag clearances and configuration changes are in a hash-chained audit log. Evidence holds identifiers and counts, never mail bodies, and verifies offline without the gateway.
Bắt đầu từ một quy trình.
Hãy cho chúng tôi biết công việc bạn muốn giao. Chúng tôi sẽ trình diễn Kurahi trên một quy trình giống của bạn và giúp bạn quyết định nên đi xa đến đâu.
Liên hệ
Trao đổi về công việc, các hệ thống liên quan và ai phê duyệt việc gì.
Liên hệYêu cầu báo giá
Nhân sự số, quản trị dữ liệu, triển khai cách ly và hỗ trợ theo SLA, theo thỏa thuận bằng văn bản.
Yêu cầu báo giáBắt đầu miễn phí
Cài Kurahi trên máy chủ của bạn và dùng miễn phí các phiên bản, hàng đợi công việc và Autopilot ở mức L0 và L1.
Bắt đầu miễn phí