Security & Trust
Security built around customer control.
Your AWS environment. Your data. Your AI.
kriyaflo is designed to run within your organization's AWS environment, giving you control over your infrastructure, identity, operational data, AI provider, credentials, retention, and access policies.
Customer-hosted · Bring Your Own AI · Customer-controlled access
Customer cloud
kriyaflo runs where your business runs.
kriyaflo's production deployment is designed to operate within the customer's AWS account.
The customer controls the environment in which kriyaflo operates, including cloud access, networking, identity, application data, storage, retention, monitoring, and connected services.
Your AWS environment
Customer-selected
Runs in your AWS environment
kriyaflo is deployed into infrastructure controlled by your organization.
Bring Your Own AI
You select your approved AI provider and provide and control the applicable credentials. ThinkNest does not provide customer AI/model credentials.
Customer-controlled data
Operational data is stored within the Customer Environment by default.
No default vendor access
kriyaflo does not require persistent ThinkNest access to customer operational data or cloud infrastructure.
Humans stay in control
Customers configure which workflows may automate actions and which require review or approval.
Email delivery
Outside the email delivery path.
kriyaflo processes messages after they reach the connected customer mailbox. It does not sit between senders and your email provider and does not replace your organization's underlying email-delivery infrastructure.
kriyaflo boundary
kriyaflo ProcessingYour email delivery remains independent of kriyaflo processing.
AI control
Your AI provider. Your credentials.
kriyaflo does not require customers to use a ThinkNest-hosted AI model. Customers select and connect their own approved AI provider and provide the credentials used by kriyaflo.
You decide
kriyaflo can use it for
Data
Operational data stays under customer control.
kriyaflo stores operational information within the customer's environment by default, including:
Where attachment processing is enabled, attachments are stored using customer-controlled storage.
Customer-controlled storage
Customers control the environment where kriyaflo operational data is stored.
Customer-controlled retention
Retention requirements can be aligned to the customer's operational and compliance policies.
Customer-controlled integrations
Customers determine which external services kriyaflo is authorized to connect with.
Identity & access
Access starts with your identity system.
kriyaflo supports enterprise authentication and authorization controls designed to ensure that users only access the workflows and inboxes appropriate to their responsibilities.
- Enterprise SSO / OIDC
- Server-side sessions
- Role-based permissions
- Inbox-level access controls
- Customer-controlled identity provider
- Customer-controlled user lifecycle
- Customer-managed role assignments
Attachments
Attachments are checked before release.
kriyaflo supports controlled handling of email attachments before they become available for downstream processing or authorized user access.
- Received
- Quarantined
- Malware Scanned
- Validated
- Authorized Release
Attachments that do not successfully pass the configured security and authorization checks are not released through the normal download flow.
Guardrails
Automate the routine. Keep judgment where it belongs.
kriyaflo lets organizations define the right level of automation for each operational workflow.
or
Business rules
Security and operating policy expressed in business language.
Teams can define operational rules using natural language, allowing kriyaflo to reflect how the organization actually operates without requiring every rule to be implemented as custom code.
Auditability
Understand what happened — and why.
kriyaflo maintains operational history around processing, classifications, rules, workflow decisions, and actions so teams can understand how work moved through the system.
AI you can operate — and audit.
Illustrative timeline
- Email received
- Classified
- Rule matched
- Routed
- Reviewed
- Action recorded
Architecture
Designed with clear trust boundaries.
Private application environment
kriyaflo's production AWS design separates application, workflow, database, and storage responsibilities within the customer's environment.
Encryption
The canonical AWS deployment supports encryption for customer database and storage resources and HTTPS for public application access.
Customer-managed access
Administrative access to customer infrastructure remains controlled through the customer's AWS environment and identity policies.
Secrets and credentials
Credentials and integrations are designed to be controlled through customer-managed configuration and access boundaries.
Operations
Built to be operated, not just deployed.
kriyaflo includes application health, event, audit, logging, and operational monitoring capabilities that can integrate with the customer's operating environment.
Support
No standing access required.
kriyaflo is designed so that ThinkNest does not require persistent administrative access to customer operational data or cloud infrastructure.
Where support access is needed, it should be:
- Explicitly authorized
- Scoped
- Time-limited
- Revocable
- Governed by customer access controls
Support access is customer-authorized and governed by the customer's access controls.
Default
No ThinkNest operational access
Customer authorization
Explicit and scoped
Temporary support access
Time-limited, under your controls
Revoked
Access removed
Need the details?
Security, IT, Legal, and Procurement teams can request additional documentation as part of an enterprise evaluation. Available documentation may include:
- Customer Security Architecture
- Architecture and data-flow documentation
- Shared Responsibility Model
- AI data handling information
- Deployment requirements
- Access-control documentation
- Security questionnaire responses
- Data processing terms
- Enterprise legal documentation
FAQ
Security questions, answered.
Where does kriyaflo run?+
kriyaflo's current production deployment is designed for the customer's AWS environment.
Does kriyaflo host our AI model?+
No. Customers select their approved AI provider and provide the credentials used by kriyaflo.
Does ThinkNest have access to our operational data?+
kriyaflo does not require persistent ThinkNest access to customer operational data or infrastructure. Any required support access is subject to customer authorization and controls.
Where is our kriyaflo operational data stored?+
kriyaflo operational data is stored within the Customer Environment by default.
Does data ever leave our AWS environment?+
Customer-configured external services—such as an AI provider, email provider, or other integration—may receive authorized information according to the customer's configuration and agreement with that provider.
Can we control automation?+
Yes. Customers configure business rules, automation settings, routing logic, and human-review requirements.
Does kriyaflo support SSO?+
kriyaflo supports standards-based enterprise authentication using OIDC.
How are email attachments protected?+
kriyaflo supports controlled attachment handling that includes quarantine, malware scanning, authorization checks, and clean-file release.
Does kriyaflo provide audit information?+
kriyaflo maintains operational and audit information for relevant processing, rules, and workflow activity.
Can our security team review more detailed documentation?+
Yes. Additional technical, security, architecture, data-flow, and due-diligence documentation is available during enterprise security review.