Minimum necessary access
Every connection starts with the smallest practical set of systems, data, and permissions needed for the job.
Security & data handling
Control should be designed in—not added later.
We scope access, data handling, testing, and human approval around the actual risk of each custom AI workflow.
Default control model
Defined access. Visible decisions.
AccessOnly what the workflow needs
ActionsLimited to the agreed job
ExceptionsEscalated to a named owner
AutonomyExpanded only after evaluation
Minimum access
Human approval
Tested expansion
Our default design standard
Every permission should have a reason.
Project-specific controls depend on the systems involved and the customer’s requirements. These principles guide the architecture before implementation begins.
Secrets stay out of workflow files
Credentials belong in the approved secret-management mechanism for the selected platform—not in prompts or documentation.
Sensitive actions stay reviewable
Customer-facing, financial, access-related, and other high-impact actions can require explicit human approval.
Representative testing before launch
The workflow is evaluated with normal cases, edge cases, incomplete inputs, and expected failure conditions.
Versioned changes
Instructions, resources, tests, and known limitations evolve together so changes remain understandable and reversible.
Defined offboarding
Access removal, credential rotation, retained artifacts, and deletion responsibilities are agreed for the engagement.
The data lifecycle
From first access to offboarding.
The right controls depend on what the workflow can read, infer, and change. We make those boundaries explicit across the engagement.
- 01
Define the boundary
We identify the business purpose, required data, system owners, sensitivity, and actions the workflow may take before requesting access.
- 02
Agree the connections
The selected platforms, permission levels, credential method, model-provider terms, and human approval points are documented for the project.
- 03
Test with controlled examples
Representative work and edge cases are used to evaluate quality, unsafe actions, missing context, and the correct escalation path.
- 04
Launch with visible control
The team can see what the workflow received, what it concluded, what action it recommends, and where a person must decide.
- 05
Review, revise, and offboard
Quality and exceptions are reviewed over time. When work ends, access and retained project material follow the agreed offboarding plan.
The Grokkit website
Current platform data controls.
Payments
Payment card details are handled by Razorpay and do not reach Grokkit’s servers.
Account and order data
Account and order data is stored in Supabase with row-level security applied to authenticated access.
Sessions and tracking
Grokkit uses an httpOnly session cookie and does not use third-party advertising or tracking cookies.
Last reviewed: September 11, 2026. Project-specific controls are documented separately for each custom workflow.
A clear boundary
What we won’t automate.
Useful automation needs judgment about where it should stop. These are the default boundaries we bring to every workflow.
Read our security approachHigh-impact decisions without an accountable person
Financial approvals, access changes, customer commitments, and other sensitive actions stay behind an explicit review point.
Unbounded access to company systems
A workflow receives only the systems, permissions, and information required for its defined job.
Uncertainty disguised as confidence
Missing context, weak evidence, and low-confidence conclusions are surfaced for review instead of presented as fact.
More autonomy before the evidence supports it
Automation expands only after quality, exceptions, and outcomes have been evaluated against an agreed baseline.
Questions
Before you connect a system.
Does every customer workflow use the same systems?
No. Data access, model providers, integrations, storage, and approval rules are specific to the workflow and agreed during scoping.
Where does project data live?
That depends on the customer’s existing systems and the agreed architecture. Storage locations, data flow, retention, and deletion responsibilities should be documented before implementation.
Can every external action require approval?
Yes. A workflow can begin in draft-only or recommendation-only mode, with explicit approval required before customer communication, financial action, or other sensitive execution.
How do I report a security or privacy concern?
Email info@kaivantech.com with the subject “Security concern.” Please avoid sending passwords, secret keys, or sensitive customer data in the first message.
Have requirements we have not covered?
Bring them into scoping before data access or implementation begins.
Discuss security requirements