Security
Request signing, encrypted collection, and how Kyli protects its own infrastructure.
Request authentication
Every API call — from your backend and from the collector SDK — is
authenticated with request signing, with built-in replay protection and key
rotation support. See The /v1/decide API
for what your integration needs to implement.
Encrypted collection payload
The behavioral data FORGE collects is transmitted over an additional application-layer encryption step, established fresh per session — on top of, not instead of, standard HTTPS transport encryption.
Fingerprint anonymization
Device fingerprints stored in the cross-customer bad-actor registry are SHA-256 hashes of combined device signals — never raw, reversible device data, and never PII.
Monitoring
Kyli's production infrastructure runs on Google Cloud Run with active error-rate alerting, structured logging, and a daily automated data-retention job — see Data retention.
Reporting a security issue
If you believe you've found a security vulnerability in Kyli, reach out through your dashboard rather than filing it as a public issue.