Security at Kennext

The short version

Kennext reads your public pages and, if you connect them, your CMS and Google accounts. The credentials you give us are encrypted and never shown again. Kennext changes nothing on your site without your approval, and you can disconnect at any time.

Kennext is a small company and we would rather be plain about where we are. We do not hold SOC 2 or ISO 27001 certification yet. This page says what we do today. Questions go to security@kennext.ai.

Where your data lives

Kennext runs on DigitalOcean in New York, in the United States, behind Cloudflare. Our database and cache are not reachable from the internet. Files and backups are stored in DigitalOcean Spaces.

Encryption

• All traffic to Kennext uses HTTPS, and browsers are told to use HTTPS only (HSTS).
• Credentials for WordPress, HubSpot, Webflow, Google, Cloudflare and Slack are encrypted before we store them. Nobody can view them afterwards, you and us included.
• Access tokens for connecting AI assistants to Kennext are stored only as a one-way hash. We show each token once.
• Links to shared reports are signed or unguessable, and they expire.

Access to your account

• Sign-in runs through Clerk. Your team has owner, admin and member roles, and only owners and admins can manage the team.
• Every request for a scan, a fix or a connection checks that you belong to that account.
• At Kennext, access to production systems is limited to the founder. Every account that reaches them (hosting, code, DNS, email and payments) requires two-factor sign-in.

What Kennext can change on your site

Kennext asks only for the permissions it needs, and each platform page lists them: Webflow, WordPress and HubSpot. Fixes are applied only after you approve them, and every change can be undone from Kennext.

When you disconnect, Kennext forgets the credential and revokes it where the platform allows. Google access is revoked at Google, and the WordPress application password is deleted on your site. HubSpot does not let an app delete a service key, so you delete it in HubSpot.

AI providers

Kennext uses OpenAI and Anthropic to analyse your pages and write fixes, and OpenAI and Perplexity to check how AI answers describe your brand.

• For analysis and fixes, we send page text (a few thousand characters per page at most), titles, descriptions and scan results.
• For AI answer checks, we send buyer-style questions and brand names. No page text.

OpenAI, Anthropic and Perplexity each state in their terms that they do not train their models on data sent through their APIs. They may keep it for a limited time under their own policies.

How long we keep data

• Page text read during a scan is deleted when the scan finishes, and any leftovers are cleared within 24 hours.
• Cached AI answers expire after 7 days.
• Database backups are kept for 30 days.
• Web server access logs are deleted after 14 days. They never record passwords, tokens or cookies. Application logs are kept until a size limit is reached, usually about 6 to 7 weeks.
• Free reports that nobody claims are deleted automatically within 45 days.

To delete your account and its data, email hello@kennext.ai after cancelling your subscription. We delete it within 30 days.

Backups

The database is backed up every night. Each backup is checked before it is stored and kept for 30 days, and once a week we restore the latest one into a test database and compare every table. The server is also backed up daily.

Who processes data for us

• DigitalOcean: hosting, file storage and backups.
• Cloudflare: network protection, and the bot check on the free scan form.
• Clerk: sign-in.
• Stripe: billing.
• Postmark: email.
• OpenAI, Anthropic and Perplexity: AI analysis, fixes and AI answer checks.
• Moz: domain authority figures.
• Google: Search Console and Analytics data, only if you connect them.

The Privacy Policy has the detail.

Reporting a security issue

Email security@kennext.ai. We reply within two business days. When testing, please do not access other customers' data or disrupt the service.

If we learn of a breach that affects your data, we will tell you within 72 hours of confirming it.

Certifications and reviews

Kennext does not have SOC 2, ISO 27001 or an external penetration test yet. We will add them as our customers need them, and we are happy to answer your security questionnaire in the meantime.