Security at Knight
Your data is protected by enterprise-grade security at every layer. We take a defense-in-depth approach — multiple independent controls, so no single failure compromises your business.
Platform Security
Built secure from the ground up
Encryption at Rest
All data stored in Supabase PostgreSQL is encrypted at rest using AES-256. Your credentials, API keys, and prospect data are never stored in plaintext.
Encryption in Transit
All connections use TLS 1.3. Data transmitted between your browser, our servers, and third-party APIs is encrypted end-to-end.
Zero-Trust Architecture
Every request is authenticated and authorized independently. No implicit trust between services — every call is verified.
Infrastructure
Reliable infrastructure overview
Knight runs on best-in-class managed infrastructure, allowing us to focus on security hardening rather than server maintenance.
Authentication
Identity & access
- Magic link email authentication via Supabase Auth
- Session tokens with automatic expiry and rotation
- Password hashing with bcrypt (cost factor 12)
- Multi-factor authentication — coming Q3 2026
- OAuth via Google and GitHub — planned
- Brute-force protection and rate limiting on all auth endpoints
Authorization
Data isolation
- Row Level Security (RLS) enforced at the database layer
- Every query is scoped to the authenticated user's ID
- No user can read, write, or delete another user's data
- Service role access restricted to server-side API routes only
- API keys never exposed to the client or browser
- Supabase policies reviewed on every schema migration
Backup & Recovery
Always recoverable
- Daily automated database backups
- Point-in-time recovery available
- Recovery Point Objective (RPO): <24 hours
- Recovery Time Objective (RTO): <4 hours
- Backup encryption matching production
Monitoring
Always watching
- 24/7 automated infrastructure monitoring
- Real-time error tracking via Sentry
- Uptime monitoring with sub-minute checks
- Alerting to on-call team within 5 minutes
- Performance monitoring on all API routes
Incident Response
Clear, fast response
- Defined P0–P3 incident severity tiers
- P0 (critical): 1-hour response SLA
- P1 (high): 4-hour response SLA
- Status page updates during all incidents
- Post-incident reviews for P0/P1 events
Vulnerability Disclosure
Responsible disclosure policy
We believe in working with the security community to keep Knight safe for everyone. If you discover a security vulnerability, we want to hear from you.
- Email security@knightagency.tech with a clear description of the issue
- Include steps to reproduce and potential impact
- We will acknowledge your report within 48 hours
- We follow a 90-day disclosure window before public disclosure
- We do not pursue legal action against good-faith researchers
- Credit will be given for responsibly disclosed vulnerabilities
FAQ
Security questions
Where is my data stored?
Your data is stored in Supabase PostgreSQL databases hosted on AWS infrastructure. Supabase is SOC 2 Type II compliant. Data residency is in the US-East region by default.
Are my API keys secure?
Your API keys (Gemini, Cohere, OpenRouter) are stored encrypted at rest and are never logged or exposed in responses. They are used only to make API calls on your behalf.
How is my Telegram account protected?
Knight uses the official MTProto protocol for Telegram. Your session credentials are encrypted and scoped only to the operations Knight needs. You can revoke access at any time from Telegram settings.
Does Knight use my data to train AI models?
No. Knight does not use your data or your prospects' data to train AI models. AI calls are made with your own API keys to providers that have their own data policies.
What happens to my data when I cancel?
When you delete your account, all personal data is removed within 30 days. Anonymized, aggregated usage statistics may be retained for platform improvement.
How do I report a security vulnerability?
Email security@knightagency.tech with a description of the issue. We follow a 90-day responsible disclosure policy and will acknowledge your report within 48 hours.