Kapintelligence by Kapnative
Security and trust

Sensitive investment data, isolated by design and reviewable to source.

Kapintelligence combines tenant controls, EU-hosted processing, role-based access and source-linked outputs for regulated institutional workflows.

DSGVO processing under an Art. 28 DPA EU data residency Tenant isolation No model training on customer data

We state controls we can evidence rather than absolutes. Source traceability is not the same as complete system auditability, and tenant architecture is a technical question with a technical answer - both are documented in the security pack, with scope and dates.

Architecture

Follow a document through the system.

Select a stage to see where data sits, which controls apply and what your security team should verify during procurement.

Stage 01 · EU

Your workspace

Documents, prompts, outputs and templates inside your tenant.

Uploaded documents, generated drafts, your DDQ and policy templates and every approval state live in a workspace scoped to your organisation. Users see only what their role and their fund assignments allow.

Tenant-scoped storage and access, per organisation Role-based permissions down to fund and document level Encryption in transit and at rest Activity history covering access, edits, approvals and exports
Verify with us
The tenant model and how isolation is enforced technically Role definitions, administrator rights and offboarding Encryption standards in transit and at rest

Each item is answered with a document, a configuration screenshot or a contract clause - not a claim on a website.

Trust architecture

Eight domains, each answered explicitly.

Data boundary
Hosting region, backups, logs, support access, model-processing region and the tenant model.
Model use
Providers, retention, no-training terms, prompt and output handling, subprocessors and support flows.
Access
Role-based access, MFA, SSO and SAML, administrator roles, privileged access and offboarding.
Protection
Encryption in transit and at rest, secrets handling, vulnerability management and penetration testing.
Audit
Access, edits, approvals, exports, retention and the customer's own availability of logs.
Resilience
Backups, recovery objectives, incident response, business continuity and status communication.
Lifecycle
Retention, deletion, portability, legal hold and the contract-end process, including GDPR data-subject rights.
Assurance
Certification status, independent reports, control mapping and the customer security review.
Regulatory framing

Designed to support regulated European investment workflows.

Kapintelligence is operated in accordance with the EU General Data Protection Regulation (GDPR / DSGVO). Personal data is processed on the customer's instruction under a data processing agreement (Auftragsverarbeitungsvertrag, Art. 28 GDPR), with processing and storage in EU regions. For customers in Germany, the German Federal Data Protection Act (BDSG) applies alongside the GDPR.

Beyond data protection, Kapintelligence provides controls that can support customer obligations under relevant operational-resilience and investment-governance frameworks.

Applicability and compliance remain customer-specific. Detailed control mapping is available during procurement. We do not describe the platform as compliant with a regulation on your behalf.

Certification status

Stated plainly, never implied.

We publish a certification only once it has been issued, with its scope and date. Until then we share the programme status, the scope under assessment and the current penetration-test and control evidence.

No badge on this site represents a certification that has not been issued. Ask for the current status in writing and it will be in the security pack.

Procurement

The security pack, in one request.

Sent to named security, risk and IT contacts, with a working session if your review requires one.

Qualified request: we ask for your role and organisation so the right documents and the right people are involved.

Architecture and EU hosting overview Data flow and model-provider diagram GDPR data processing agreement (Auftragsverarbeitungsvertrag), TOMs and current subprocessor list Retention, deletion and portability policy Access control, MFA and SSO description with audit logging scope Incident response, backup and disaster-recovery overview Penetration-test and certification status, with scope and dates Control mapping for relevant European customer obligations

Security questions we get asked

Through EU data residency, tenant-scoped access, role-based permissions, source-linked outputs, configurable review steps and activity logging. Processing is GDPR-compliant under a data processing agreement (Auftragsverarbeitungsvertrag) with each customer as controller; for German customers the BDSG applies alongside. Detailed security documentation and control mapping are available during procurement.

You can open any AI-generated output to view its supporting evidence and source passages, plus its validation state and reviewer history. Private model reasoning is not exposed - what you review is evidence and rationale, which is what an audit needs.

You can start without a core-system integration, through secure document upload. Your security review, and SSO or API work if you want it, does involve your IT and security teams - we plan that path with you in week 0 rather than pretending it does not exist.

Bring your security questionnaire.

We answer it against the current architecture and contracts, in writing, with named owners.