Kairos by OurGrowth
Trust, with the evidence behind it.
For compliance and IT-risk reviews. Unfinished work is marked Coming.
Who operates Kairos
Harmonyx Solution Co., Ltd., registered in Thailand (tax ID 0105563018996). Each organisation has its own deployment. Where data lives depends on the option you choose.
Certification
Developed by HarmonyX, which is ISO/IEC 27001 certified. Extending certification to the hosted service is in progress; OurGrowth's SOC 2 Type I and ISO/IEC 42001 are in progress.
Controls you can verify
Tamper-evident audit log
Hash-chained; a check reports any part that was changed or is missing.
Model providers by data class
Admins choose which providers may receive confidential and regulated data.
Restricted data stays inside
After seeing restricted data, a workspace cannot browse, search or act outside the organisation.
Approval for outside effects
Through the connectors we ship, actions outside Kairos wait for a person to approve them.
Unattended writes wait for a person
A scheduled run's writes wait for approval. In confidential and regulated workspaces, the approver is an administrator who is not responsible for the schedule.
Outside content is marked untrusted
Reading web pages, inbound mail or a user-added MCP server marks the workspace untrusted. Its actions outside the organisation then wait for a person.
Audit export to your SIEM
Audit events can also go to your own OpenTelemetry collector or SIEM. People appear by pseudonym, and events missed while the collector is down are sent later.
Patching deadlines
Production fixes by severity: 1 day critical, 7 high, 30 moderate, 90 low.
In progress
ISO/IEC 27001 for the hosted serviceComing
SOC 2 Type I and ISO/IEC 42001Coming
Exit (export and teardown), rehearsed end to endComing
Status page and availability commitmentComing
Hardening for air-gapped sitesComing
Documents on request
Sent after we confirm your organisation.
Sub-processor listOn request
Data processing agreement (PDPA)On request
Security questionnaire answersOn request
Report a vulnerability
Email security@ourgrowth.ai. We acknowledge reports within three business days.