Security & Compliance

LAST UPDATED: JUNE 2026

1. Signal Integrity & Audit Logging

All signal state changes are logged to an internal, append-only ClickHouse ledger with timestamps and metadata. A continuous SHA-256 hash chain links consecutive signal records, so silent after-the-fact edits are detectable internally. This ledger records when a prediction was made and what was predicted; it does not establish that any prediction was correct or profitable. The chain is tamper-evident internally (append-only, hash-chained); it is not yet externally anchored, and public verification is on the roadmap, not yet live.

  • SHA-256 Hash Chain: Each signal record is cryptographically linked to the previous one. A silent edit to any record breaks the chain and is detectable internally.
  • Append-Only Audit Log: Every prediction, signal, and state transition is written to an append-only ClickHouse ledger (immutable in the MergeTree sense — records are not updated in place). This log is internal and not externally anchored; it is not publicly queryable — public verification is on the roadmap, not yet live.
  • TLS Encryption: All web and API traffic is encrypted in transit.

2. Access Controls

Administrative access to production infrastructure follows the principle of least privilege. Access is restricted to key-based authentication with multi-factor verification on all critical systems. Password-based authentication is disabled across all production endpoints.

3. Data Encryption

All network traffic is encrypted via TLS. Data at rest is protected through access-controlled storage on self-owned infrastructure. No third-party cloud providers handle proprietary code or signal data.

4. Data Privacy & Consent

We design our data handling to align with the principles of the California Consumer Privacy Act (CCPA), Telephone Consumer Protection Act (TCPA), and EU General Data Protection Regulation (GDPR):

  • Consent: Consumer data is processed only with verified opt-in consent.
  • Data Minimization: Records are retained only as long as needed to complete the intended service.
  • Deletion Rights: You can request full deletion of your data or a disclosure of information held by emailing [email protected].

5. Infrastructure Security

All infrastructure is self-hosted on owned hardware with network-level access controls. No third-party cloud providers have access to proprietary code, model weights, or signal data. All administrative sessions require multi-factor authentication.

Disclaimer

THIS IS NOT INVESTMENT ADVICE. Kairos Signal is not a broker-dealer, investment advisor, or financial services provider. This is a machine learning research product. "Alpha" refers exclusively to the mathematical α coefficient in regression residuals, not guaranteed returns. All outputs are for research and informational purposes only.