kolm security

Security.
By construction.

Kolm's trust boundary is a property of the file format, not a marketing line. Receipts are HMAC-bound. Artifacts are signed. The user's data never leaves the device.

Trust boundary.

The cloud sees what the developer authored. The device reads what only the user can. Two halves, never confused.

01 · Cloud kolm compile

Cloud sees what you authored.

  • task spec
  • seed examples
  • evals
  • target devices

Never the user's email, photos, journal, health, finance, or private documents.

02 · Device artifact.personalize()

Device reads what only the user can.

  • local memory
  • local index
  • private user data
  • nothing leaves

The artifact is signed, sandboxed, and offline. Cloud cannot reach in. Device does not phone out.

Kolm's cloud sees your app's task spec, seed examples, evals, and target devices. The user's private data is only read by the on-device runtime.

Threat model.

We assume the attacker has full root on the device, full network observation, and a copy of every signed artifact ever published. The contract still holds.

An attacker cannot forge a kolm receipt.

Receipts are an HMAC-SHA256 chain over (artifact_hash || eval_set_hash || eval_score || judge_id). The chain key derives via HKDF-SHA256 from the signing identity. Without that identity, the chain cannot be re-formed.

If a single byte changes in the artifact, the eval set, the score field, or the judge ID, verification breaks. There is no soft failure mode. Either the chain is valid, or it is not.

Property. Even with full root access to the runtime, an attacker cannot forge a kolm receipt or alter a bound eval claim. Tampering breaks the chain at verify time.

Receipts bind claims, not just bytes.

A receipt does not just hash the artifact. It binds (artifact_hash, eval_set_hash, eval_score, judge_id) as a single message and chains them under HMAC-SHA256, with the chain key derived via HKDF-SHA256 from the signing identity.

If your auditor asks "how was this model tested", the answer lives inside the file. The score is bound to the exact eval set that produced it, on the exact judge that scored it, on the exact artifact you shipped.

Receipts are public, deterministic, and verifiable offline. The reference verifier is ~30 lines of Go and ships MIT under RS-1-receipts. Read the algorithm ›

Compliance posture.

In flight: SOC 2 Type I, target Q4 2026. SOC 2 Type II target Q2 2027. BAA and DPA available on request for paid plans.

SOC 2

Type I in flight, Type II Q2 2027.

Type I report targeted Q4 2026. Type II window opens immediately after.

in flight
HIPAA

BAA available on request.

Compile is opt-in pass-through. Personalize never sees PHI.

on request
GDPR & EU AI Act

DPA available, evals declared.

Receipts are the exact artifact disclosure the EU AI Act asks for.

on request

Hardening shipped.

A running log of the boring, load-bearing security work. Dated, specific, verifiable in the open codebase. We publish what we land, not what we plan.

2026-04-25
scrypt password hashing. New signups, resets, and changes use a memory-hard KDF; legacy logins opportunistically rehash. N=2^15, r=8, p=1.
2026-04-25
OAuth tokens AES-256-GCM at rest. Provider tokens encrypted with a server-only key. Backward-compat decrypt + lazy re-encrypt on refresh.
2026-04-25
CSP unsafe-eval removed. All inline eval paths excised; recipe execution sandboxed in a Worker with explicit message contract.
2026-04-25
Session cookie hardened. SameSite=Strict, HttpOnly, Secure on all session cookies. localStorage retained as opt-in dev mode.
2026-04-25
WCAG 2.1 AA accessibility pass. Color contrast, focus rings, keyboard traps, semantic landmarks audited across the marketing surface.
2026-05-06
HMAC-SHA256 receipt chain · HKDF-SHA256 derivation. Verifier ships in ~30 lines of Go, MIT-licensed under RS-1-receipts. Anyone can re-form the chain offline.

SOC 2 Type I auditor selection underway. We will name the firm publicly the day we sign — not before.

Sub-processors.

A complete list of vendors that may process customer data, scoped to the listed purpose only.

VendorPurposeRegion
StripeSubscription billing, payment cards.US, EU
CloudflareCDN, DDoS, WAF for kolm.ai.Global
PineconeEval set indexing for compile only.US
AnthropicFrontier judge model, customer key only.US
PostmarkTransactional email (signup, receipts).US

We notify customers 30 days before adding a new sub-processor that touches personal data.

Vulnerability disclosure.

If you found something, write to us. We acknowledge within 48 hours and aim for a 90-day public disclosure window after a fix ships.

Tell us at hi@kolm.ai.

Scope. kolm.ai, the cloud compile API, the public registry, the iOS, Android, and Web SDKs, and the .kolm format itself.

Out of scope. Customer-published artifacts (those are the customer's). Findings against test infrastructure (status.kolm.ai). Social engineering of staff.

Safe harbor. We will not pursue legal action for good-faith research that respects user data and gives us reasonable time to respond.

PGP fingerprint: 0xA3F1 · pending publication Use email signing only after we exchange a signed handshake.

Open specs.

The contract is in the open. MIT-licensed, versioned, signed. No vendor lock by construction.

RS-1

Receipt schema.

The HMAC chain, the bound fields, the verifier algorithm.

Read RS-1 ›
Manifest v0.1

Declarative graph.

Typed nodes, typed edges. No JIT, no eval, no dynamic class loaders.

Read manifest ›
Receipts v0.1

Receipts the format.

JSON, deterministic, embeddable in CI, embeddable in the artifact.

Read receipts ›

Signed binaries.

Every kolm SDK ships through the platform's first-party signing chain. No sideloaded code. No JIT.

iOS · Apple notarization.

Native runtime parses a typed manifest. No eval(), no new Function(), no downloaded executable code. App Review 2.5.2 safe by construction.

Android · Play Integrity.

Native AAR signed and Integrity-attested at runtime. Manifest parser does not call any reflection or class loaders.

Web · subresource integrity.

SDK bundles ship with SRI hashes. WebGPU and WASM only. No remote JS evaluation.

Server · reproducible builds.

CLI binaries are reproducible from the public source tree. Hashes published with each release.