Security & Compliance

1. Signal Integrity & Audit Logging

The paper traders' entry signals (paper trading only; no orders are placed) are copied, best-effort, into an internal, append-only ClickHouse ledger with timestamps and metadata, so a record can be missing. Records written from 14 June to 2 August 2026 carry a SHA-256 chain_hash and a prev_hash naming an earlier record's hash, and the hash covers each record's timestamp, asset, action and score, so a silent edit to one of those fields is detectable internally (the regime and features_hash fields are not hashed). Records written since 17 August 2026 carry neither, so no hash chain covers them. No ledger record is signed and the ledger is not externally anchored. Paid API tiers can read its rows, with each row's chain_hash, prev_hash and (empty) signature, at /v1/signals. This ledger records when a prediction was made and what was predicted; it does not establish that any prediction was correct or profitable. What is signed is the data API: its responses carry an ed25519 signature in the X-Kairos-Signature header, with the public key at /.well-known/kairos-signing-key.json. Each day's batch of collected data values is Merkle-rooted and timestamped to Bitcoin through OpenTimestamps.

• Partial SHA-256 Hash Chain: Each ledger record written from 14 June to 2 August 2026 is linked to an earlier record's hash, so a silent edit to the timestamp, asset, action or score of one of those records breaks the chain and is detectable internally (regime and features_hash are not hashed). Records written since 17 August 2026 are not chained, and no record is signed.
• Append-Only Audit Log: Entry signals are copied, best-effort, to an append-only ClickHouse ledger (immutable in the MergeTree sense — records are not updated in place). This log is not externally anchored; paid API tiers can read its rows at /v1/signals, and public verification is on the roadmap, not yet live.
• TLS Encryption: All web and API traffic is encrypted in transit.

2. Access Controls

Administrative access to production infrastructure follows the principle of least privilege. Access is restricted to key-based authentication with multi-factor verification on all critical systems. Password-based authentication is disabled across all production endpoints.

3. Data Encryption

All network traffic is encrypted via TLS. Data at rest is protected through access-controlled storage on self-owned infrastructure. No third-party cloud providers handle proprietary code or signal data.

4. Data Privacy

The product is supply-side telemetry for decentralized physical infrastructure networks, read from those networks' own public APIs and from public chain data. We do not sell personal data, and we do not operate a lead-generation or marketing-contact product.

What we hold about the people and agents who use the service:

• Accounts and API keys: the key, the email address it was issued to (an agent that registers without one is given a placeholder address), and the IP address, user-agent string and request header chain of the request that created it. Request and purchase history is kept against the key, as are any webhook URL you register and any message you send us.
• Server logs: our web server records each request's IP address, user-agent, referrer and browser language, and keeps them for up to 15 days. Our MCP server records the IP address, user-agent and tool name of each tool call. Its per-IP daily call counters cut each address to its network prefix (/24 for IPv4, /48 for IPv6) after 30 days. A copy of the web logs from 29–30 August 2026, kept for traffic analysis, holds network prefixes only.
• Page views: counted without cookies. We store the page, the referring page and the browser's user-agent string, not your IP address.
• Payments: card details are held by Stripe, not by us. We keep the checkout email, Stripe's customer and subscription identifiers and the IP address that first retrieves a purchased key. For USDC and x402 payments we keep the paying wallet address, the transaction hash and, for a verified wallet, the signed message.
• Retention: only the web-server logs, the per-IP call counters and the traffic-analysis copy have an automatic limit today; the other records listed here are kept until they are deleted. Our nightly and six-hourly database backups are encrypted before they leave our servers, and some are kept indefinitely, so a deleted record can persist in an encrypted backup. Older plaintext copies of some of the records described below also remain in private GitHub repositories we control; their removal is pending.
• Data from earlier work: real-estate and lead-generation work that preceded this product, closed in August 2026, left personal data on our systems: contact and lead records (names, postal and email addresses, phone numbers, IP addresses), enriched consumer profiles (employers, estimated incomes, credit tiers, debt and lien amounts), email message bodies with sender names and addresses, and public property records that name owners, buyers and sellers. It is not part of the product and is not sold. Its removal began on 21 October 2026.
• Access and Deletion: you can request disclosure of what we hold about you, or its deletion, by emailing [email protected]. This is how we meet CCPA and GDPR subject-rights requests.

5. Infrastructure Security

All infrastructure is self-hosted on owned hardware with network-level access controls. No third-party cloud providers have access to proprietary code, model weights, or signal data. All administrative sessions require multi-factor authentication.

Disclaimer

THIS IS NOT INVESTMENT ADVICE. Kairos Signal is not a broker-dealer, investment advisor, or financial services provider. This is a machine learning research product. "Alpha" refers exclusively to the mathematical α coefficient in regression residuals, not guaranteed returns. All outputs are for research and informational purposes only.