Security

Overview

Kibbe.ai handles API keys and, for many customers, their full product catalogs. Security is built into how we design the API, not added on later.

API keys

Keys are scoped to one environment (sandbox or live) and can be restricted to read-only. They are shown once at creation and stored hashed. You can rotate or revoke a key instantly from the dashboard.

Tenant isolation

Each organization’s catalogs, indexes and usage data are logically isolated. Search and similar-item results only ever include items from the catalogs your key is allowed to read.

Encryption

All traffic to api.kibbe.ai uses TLS 1.2 or higher. Customer data at rest is encrypted with AES-256.

Webhooks

Every webhook delivery is signed with HMAC-SHA256 using a per-endpoint secret, with a timestamp so you can reject replays.

Internal access

Production access is limited to a small on-call team, protected by SSO and hardware keys, and logged. Access follows least-privilege principles.

Responsible disclosure

Found a vulnerability? Email hello@kibbe.ai. We will acknowledge good-faith reports promptly and won’t take legal action against researchers who report responsibly and give us reasonable time to fix the issue.

Certifications

We don’t hold SOC 2 or ISO 27001 certification yet. We plan to pursue independent certification and will update this page when we do.

Contact

Questions about our security practices can be sent to hello@kibbe.ai.