Klyrentra AI Home

Security

Last updated: 2026

This page describes the security controls Klyrentra AI has in place today. It is deliberately specific: we only claim what is actually implemented in the current version of the product.

Authentication

  • Sign-in with email & password or Google, delivered through our managed authentication provider (Supabase Auth).
  • Passwords are stored as bcrypt hashes by the auth provider; we never see or store plaintext passwords.
  • Have-I-Been-Pwned checks are enabled: passwords found in known breach corpora are rejected on sign-up and password change.
  • Session tokens are short-lived JWTs stored in the browser and rotated by the auth provider.

Connecting Google (Gmail & Calendar)

  • Access is granted through Google's standard OAuth 2.0 consent flow. We never ask for or see your Google password.
  • We request read-only scopes only: gmail.readonly, calendar.readonly, plus openid and your Google email address so you can tell which account is connected.
  • OAuth refresh and access tokens are encrypted at rest with AES-256-GCM before they are written to our database. The encryption key is stored as a server-only secret.
  • Disconnecting Google from Klyrentra deletes our stored tokens and calls Google's revoke endpoint so the grant is invalidated on Google's side too.
  • You can also revoke access from your Google Account at any time via myaccount.google.com/permissions.

Data storage

  • Application data is stored in a managed PostgreSQL database (Supabase). Transport is TLS 1.2+.
  • Every user-facing table has row-level security (RLS) enabled — a signed-in user can only read and write their own rows.
  • Admin operations run through a service role that is available only in server-side code paths.

Minimal permissions

  • We request the smallest OAuth scope set that lets Klyrentra do what you asked for.
  • We do not request send, modify, or delete scopes for Gmail. Klyrentra cannot send email on your behalf.
  • We do not request write scopes for Google Calendar.

AI processing

  • AI briefings and email reply drafts are produced by Google Gemini via the Lovable AI Gateway.
  • Content is sent to the model only when you explicitly request a briefing or draft.
  • We do not use your Gmail or Calendar data to train or improve any generalised AI/ML model.

Networking & abuse

  • Sensitive server routes require authentication; the cron endpoint that triggers scheduled briefings requires a shared secret in the request header.
  • Per-user rate limiting is applied to AI endpoints (briefings, replies, chat) to prevent abuse.
  • The application sends a strict transport security header (HSTS) and a conservative Content Security Policy.

What we do not claim

Klyrentra is a young product. We do not currently hold SOC 2, ISO 27001, HIPAA, PCI-DSS, or similar third-party attestations, and we have not commissioned an independent penetration test. If any of those matter for your business, please contact us before onboarding.

Reporting a vulnerability

Email security@klyrentra.com with reproduction steps. We ask that you avoid automated scanning of production and never access data that isn't your own. The contact address is a placeholder while our production domain is being finalised.