Kleidon security and data handling.

What this page covers

Kleidon is an early-access security service from Quelris for B2B SaaS teams of 10 to 50 people. We check how Google Workspace, GitHub and AWS are set up, help fix what we find, and answer the security questionnaires your customers send. This page says how we handle your systems and data while we do that.

• Read-only access by default, through accounts and roles you create and control.
• No passwords, API keys or tokens stored on our side.
• No change to your systems without your written approval.
• Your data used only for your engagement, and deleted within 30 days after it ends.
• Your data never used to train AI models.
• Security incidents reported to you within 72 hours of discovery.

How we access your systems

You create our access in your own accounts, give it the narrowest read-only scope that does the job, and can remove it at any time.

• Google Workspace: a guest or delegated admin role limited to read-only reports and settings. Remove the role or suspend the account to end it.
• GitHub: an outside collaborator or a GitHub App with read-only permissions on the organization settings we check. Remove the collaborator or uninstall the app to end it.
• AWS: an IAM role in your account with the AWS-managed SecurityAudit policy, assumed from our account with an external ID. Delete the role or change its trust policy to end it.

We ask for each access when the work needs it, not all at once. Each access is tied to a named person at Quelris, not a shared login. When the engagement ends, we ask you to remove every access and confirm in writing that we no longer use it.

Credentials

We never ask for, receive or store your passwords, API keys, access tokens or recovery codes.

• Access works through roles and accounts you grant, so there is nothing secret to hand over.
• AWS access uses short-lived credentials from assuming your role; no long-lived access keys are created for us.
• If a secret is sent to us by mistake, we delete it, tell you the same day, and ask you to rotate it.

Your data

We keep only what the work needs, in one encrypted place, and delete it within 30 days after the engagement ends.

• Security questionnaires you send: used to draft the answers; kept in encrypted storage on our work laptop and in our email.
• Settings and findings from read-only checks: used to report what to fix; kept in encrypted storage on our work laptop.
• Your team's names and work email addresses: used to contact you; kept in our email.
• Drafted answers and reports: yours to keep; our copies are deleted 30 days after the engagement ends.

We do not copy customer data from your production systems, such as your users' records, databases or files. On request we delete your data sooner and confirm it in writing.

Tools and AI

Two outside services touch your data: our email provider and one AI provider, used only under terms that do not allow training on your data.

• Zoho Corporation: email with your team at hello@quelris.dev. It sees the messages and attachments you send us.
• Anthropic: an AI model that drafts questionnaire answers and sorts findings. It sees questionnaire text and findings, with secrets and personal data removed first. Our plan is set so the provider does not train on our inputs and does not retain them.

AI drafts; a person at Quelris checks every answer before you see it, and you approve it before it goes to your customer. AI never runs commands in your systems and never holds access to them. If you prefer no AI on your engagement, say so and we work without it. We tell you before adding any new service that would see your data.

Changes to your systems

By default your team makes the fixes; we change something ourselves only with your written approval for that specific change.

• We send the finding, the exact change we suggest, and how to undo it.
• Your team applies it, or approves us to apply it, in writing by email or in a ticket.
• Any change we apply uses temporary access you grant for that change and remove afterwards.
• We record what changed, when and who approved it, and send you the record.

Our own security

We hold ourselves to the controls we check for you.

• Multi-factor authentication on every account we use for your work: email, GitHub, cloud and the password manager.
• One work laptop with full-disk encryption, automatic screen lock and automatic OS updates.
• Passwords for our own accounts kept in a password manager, unique per service.
• No customer data on personal devices or in personal accounts.
• Our own AWS and GitHub accounts reviewed every quarter for unused access.

Incidents

If your data or access is exposed on our side, we tell you within 72 hours of finding out, and sooner when we can. The first notice says what happened, which of your data or access is involved, and what you should do now, such as removing a role. We send updates until it is closed, then a written summary of the cause and what we changed. Notices go to the contact you name at the start of the engagement, by email and phone.

Contact and changes

Questions about this page go to hello@quelris.dev; we reply within two business days. When this page changes, we update the date at the top and email current customers before the change applies to their work. A signed agreement with you, such as an NDA or service agreement, takes precedence over this page where they differ.