Security Overview

Your data lives in the Hosting Region you choose at sign-up, the United States (AWS, Northern Virginia) or Germany (OVHcloud, Frankfurt), and does not leave it.

What we hold, and what we don’t

Kendis reads a narrow set of fields from your work items: the item key, title, status, story points, sprint or iteration, project name, and the identifiers of linked items. Descriptions, attachments and comments are never fetched; they stay in your Jira or Azure DevOps instance. For people, we hold first name, last name and email address, and nothing else. Webhook updates from your ALM tool arrive as the standard payload; Kendis parses only the fields above, updates its own record, and discards the rest.

Architecture

Each Hosting Region is a separate deployment. In the United States, Kendis runs inside an Amazon VPC in the us-east-1 region, with the application in its own subnet and the database and storage in private subnets with no direct internet access. All traffic enters through an internet gateway behind AWS WAF and AWS Shield. The database is MongoDB Atlas; application storage uses Amazon EBS. Monitoring is provided by Amazon CloudWatch, CloudTrail and GuardDuty, with host-based intrusion detection on the application servers. The Germany region runs on OVHcloud in Frankfurt, with bunny.net for content delivery and Scaleway for transactional email, all within the EEA. Production, QA and development are separate environments. Production data is never copied into test or development systems.

Access control

Every engineer with production access has a named individual account. There are no shared credentials. Multi-factor authentication is required on production, and access to the AWS and OVHcloud consoles is restricted to an allowlist of IP addresses. Production access is limited to a small number of named engineers who need it for operations and maintenance, and every administrative action is logged. For your users, Kendis supports single sign-on with SAML through Okta and Azure AD (Microsoft Entra ID), and role-based access within the product. Licence holders can be reassigned by your administrators without contacting us.

Encryption

All data is encrypted in transit using TLS and at rest using AES-256. This covers the application database, block storage and backups in both regions. The connection between Kendis and your Jira or Azure DevOps instance is over HTTPS in both directions: Kendis calls your ALM tool’s REST API, and your ALM tool calls Kendis’s webhook endpoint.

Backups and recovery

Backups are taken automatically, encrypted, and stored within the same Hosting Region as the live data. They are never moved to a third-party or offsite location outside the region. A disaster-recovery environment exists in the same region and is tested on a recurring basis as part of our ISO 27001 management system.

Incident response

Kendis operates an incident-response process under its ISO 27001 management system. If we become aware of a personal data breach affecting your data, we notify you without undue delay and within 72 hours, with enough information for you to meet your own reporting obligations, and we cooperate with your investigation and remediation. Support is available by email and live chat from 08:00 to 20:00 GMT on business days, with issues classified by severity and an initial response within four hours for the two highest severities.

Testing and assurance

Kendis Oy holds ISO/IEC 27001:2022 certification (certificate 123131, Prescient Security, valid to 30 January 2029, subject to annual surveillance audits). An independent penetration test is carried out at least annually; the summary report is available in the document library under NDA. Our infrastructure providers’ SOC 2 Type II reports are available through their own compliance programmes and we pass them on.

Kendis AI

Kendis AI is optional and off by default. Only a Super Admin in your organisation can enable it, and doing so accepts the Kendis AI Terms. Your content is processed transiently by the AI Provider (currently Amazon Web Services, Bedrock), is never used to train third-party models, and Kendis requires the same commitment from any provider or subcontractor. Any stored inputs and outputs are deleted within 90 days. You own the outputs. Disabling Kendis AI at any time stops all transmission to the AI Provider without affecting the rest of your subscription. In the product, Kendis AI appears under the name Charlie.

When you leave

On expiry or termination you can ask, within 30 days, for a complete copy of your data by secure transfer in a reasonable format, deletion of all copies, or both. If you make no election, we delete your data within 90 days. We will certify deletion in writing on request.