Security
Security at KYNYTYX.
What protects your account today, and how to tell us about a problem. If you think you have found a vulnerability, email [email protected].
Report a vulnerability.
We want to hear about anything that could expose someone's health record or account. Reports from researchers, clinicians and patients are all welcome.
-
Where to send it
Email [email protected]. Say what you found, where it is, and the steps to reproduce it. Screenshots or a short proof of concept help.
-
What we ask of you
Test only against an account you own. Do not open, change or keep anyone else's data; if you reach some by accident, stop and tell us. Do not run tests that slow the service down for other people, and do not send spam or try to trick anyone at KYNYTYX. Give us a reasonable time to fix the problem before you publish it.
-
What happens next
We will reply to the address you wrote from and tell you when the problem is fixed. There is no paid bug bounty today.
-
Machine-readable contact
The same contact details are published at /.well-known/security.txt, in the format RFC 9116 describes.
How your account is protected.
- Encrypted connections
- Connections to kynytyx.io and app.kynytyx.io use TLS 1.2 or later. Both send HSTS, so a browser that has visited over HTTPS will not fall back to an unencrypted connection.
- Passwords
- Passwords are stored only as bcrypt hashes. Nobody at KYNYTYX can read your password or tell you what it is.
- Two-step sign-in
- You can add an authenticator app, with one-time backup codes, or a passkey. With an authenticator turned on, a password alone does not sign you in.
- Sessions
- The web app keeps you signed in with short-lived access tokens, held in the open page and in a cookie that page scripts cannot read. The long-lived refresh token lives only in such a cookie, which other sites cannot send, and we store it only as a SHA-256 hash.
- Limits on sign-in attempts
- Sign-in, registration and password reset are rate limited, which slows down anyone trying to guess a password.
- Browser protections
- The app sends a Content Security Policy that limits where scripts can load from, and it refuses to be shown inside another site's frame.
How Course reads your documents.
When you add a document to Course, such as a lab report or a clinic letter, software reads it and suggests entries for your record. This is where that happens and what it sees.
-
Taking the text out
Our server takes the text from the document: the text already in the file or, for a scan or photo, text recognition (OCR) software that runs on that same server.
-
Suggesting entries
That text and the document's file name go to an AI language model that runs on a separate machine we operate on our private network. The model receives the text only, not the document's images. Nothing it suggests is added to your record until you confirm it.
-
Whether it leaves our machines
It does not. The text travels to that machine only over our private network, and it is encrypted in transit. Reading a document does not send it to any outside AI company or other third party.
-
What the model keeps
By default, the model software holds the text only in memory while it works and does not write it to disk or to its logs.
What this page does not claim.
KYNYTYX does not claim any security certification or regulatory compliance status. If that changes, this page will say so and name the evidence.