Security & Compliance

LAST UPDATED: JUNE 2026

1. Signal Integrity & Audit Logging

All signal state changes are logged to an internal, append-only ClickHouse ledger with timestamps and metadata. A continuous SHA-256 hash chain links consecutive signal records, so silent after-the-fact edits are detectable internally. This ledger records when a prediction was made and what was predicted; it does not establish that any prediction was correct or profitable. The chain is tamper-evident internally (append-only, hash-chained); it is not yet externally anchored, and public verification is on the roadmap, not yet live.

  • SHA-256 Hash Chain: Each signal record is cryptographically linked to the previous one. A silent edit to any record breaks the chain and is detectable internally.
  • Append-Only Audit Log: Every prediction, trade, and state transition is written to an append-only ClickHouse ledger (immutable in the MergeTree sense — records are not updated in place). This log is internal and not externally anchored; it is not publicly queryable — public verification is on the roadmap, not yet live.
  • TLS Encryption: All web and API traffic is encrypted in transit.

2. Access Controls

Administrative access to production infrastructure follows the principle of least privilege. Access is restricted to key-based authentication with multi-factor verification on all critical systems. Password-based authentication is disabled across all production endpoints.

3. Data Encryption

All network traffic is encrypted via TLS. Data at rest is protected through access-controlled storage on self-owned infrastructure. No third-party cloud providers handle proprietary code or signal data.

4. Data Privacy

The product is supply-side telemetry for decentralized physical infrastructure networks, read from those networks' own public APIs and from public chain data. We do not collect, process or sell personal data about consumers, and we do not operate a lead-generation or marketing-contact product.

The only personal data we hold is what an account needs to exist:

  • What we hold: the email address used to issue an API key, and usage records tied to that key. Payment details are held by Stripe, not by us.
  • Data Minimization: records are retained only as long as needed to operate the account and meet accounting obligations.
  • Access and Deletion: you can request disclosure of what we hold about you, or its deletion, by emailing [email protected]. This is how we meet CCPA and GDPR subject-rights requests.

5. Infrastructure Security

All infrastructure is self-hosted on owned hardware with network-level access controls. No third-party cloud providers have access to proprietary code, model weights, or signal data. All administrative sessions require multi-factor authentication.

Disclaimer

THIS IS NOT INVESTMENT ADVICE. Kairos Signal is not a broker-dealer, investment advisor, or financial services provider. This is a machine learning research product. "Alpha" refers exclusively to the mathematical α coefficient in regression residuals, not guaranteed returns. All outputs are for research and informational purposes only.