Identity & permissions
Role-based access, strong authentication, least privilege, joiner/mover/leaver processes, and periodic access reviews.
SECURITY, CONTROL & RELIABILITY
Trust is built into
the operating model.
KinetiPlan is being positioned for customer-hosted environments, with security and operational controls treated as product requirements—not afterthoughts.
Transparency note
This page describes intended design principles, not a certification or a claim that every control is currently implemented. Security posture, testing, and deployment readiness must be verified before production use.
CONTROL AREAS
Plan the controls
before go-live.
Customer-hosted software still requires clear ownership across application, infrastructure, identity, data protection, monitoring, recovery, and vendor support.
Data protection
Encryption in transit and at rest, protected secrets and keys, data minimization, and secure retention/disposal procedures.
Auditability
Traceable financial and administrative events, meaningful timestamps, controlled changes, and tamper-evident log strategy.
Backup & recovery
Documented backups, tested restoration, agreed recovery objectives, and evidence that restores work.
Release management
Signed/versioned releases where feasible, controlled schema migrations, rollback planning, and customer acceptance testing.
Operations & support
Defined support access, incident response, patch responsibilities, monitoring, and escalation procedures.
CUSTOMER-HOSTED DEPLOYMENT
Agree the shared
responsibility model.
Each customer deployment should have a written operating agreement. Hosting location alone does not determine security or compliance.
| Topic | Questions to resolve |
|---|---|
| Infrastructure | Who provisions, hardens, monitors, and patches servers, operating systems, databases, and networks? |
| Application | Who installs updates, manages configuration, and validates compatibility? |
| Data & keys | Who controls encryption keys, backup access, retention, exports, and secure deletion? |
| Support | What remote access is permitted, for how long, and how is it approved and logged? |
| Recovery | What recovery time and recovery point objectives are agreed, and how often are restores tested? |
| Incident handling | Who triages incidents, preserves evidence, notifies affected parties, and coordinates remediation? |
Risk mitigation and liability. How validation overrides are meant to be logged with who and why, why statutory limits such as 402(g) and 415(c) run as deterministic code rules rather than AI, and why there is no money-movement path to fail. Read the E&O risk mitigation page →
HOW THIS WEBSITE IS HOSTED
Facts you can check today.
The product's deployment model is agreed with each customer, as described above. This marketing website runs on the setup below, operated by Software Home, the team that develops KinetiPlan.
Amazon Web Services
Pages are stored in Amazon S3 in the Asia Pacific (Singapore) region and delivered worldwide through the Amazon CloudFront content delivery network.
HTTPS only
Every request is redirected to HTTPS, served over HTTP/2 with TLS 1.2 or newer, using a certificate issued by AWS Certificate Manager.
Security headers
Responses carry HTTP Strict Transport Security for one year, X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, a strict-origin-when-cross-origin referrer policy and X-XSS-Protection.
Versioned content
Object versioning is enabled on the site's storage, and a backup copy is taken before every content release, so any page can be restored to an earlier version.
Contact form handling
Inquiries are sent over HTTPS to a private function, checked for spam, stored in private storage and emailed to the team through Amazon SES from a DKIM-signed domain.
Report a vulnerability
A security contact is published at /.well-known/security.txt. Email hello@software-home.net with details and we will respond.
The demo application uses synthetic data only. This section describes this website's hosting, not a certification. KinetiPlan holds no SOC 2 or other attestations today.
TECHNICAL DISCOVERY
Let’s define your deployment requirements.
Discuss hosting, access controls, integrations, recovery expectations, and the evidence your organization needs before a pilot.