Use this file to discover all available pages before exploring further.
KaireonAI includes built-in compliance infrastructure for multi-tenant data isolation, immutable audit trails, data subject access requests (DSAR), PII masking, and configurable data retention. These features support GDPR, CCPA, and SOC 2 readiness out of the box.
Every API request is scoped to a single tenant. Cross-tenant data access is architecturally prevented at the query layer.How it works:
Tenant resolution — Each request resolves a tenantId from either the JWT session (user.tenantId) or the X-Tenant-Id header (for API key auth). API key authentication binds the tenant to the key itself, ignoring any X-Tenant-Id header to prevent spoofing.
Database validation — The resolved tenant ID is validated against the Tenant table in the database. If the tenant does not exist, the request is rejected with 403 Forbidden. The system fails closed: if the database is unreachable during validation, the request is denied.
Query enforcement — The enforceTenantFilter() helper injects tenantId into every Prisma where clause. The withTenantScope() wrapper provides scoped findMany, findUnique, create, update, and delete methods that automatically include the tenant filter. Calling these helpers without a tenantId throws an error.
Single-tenant mode — For self-hosted deployments, set SINGLE_TENANT_MODE=true to bypass tenant resolution and use tenantId: "default" for all requests.
Every database query in every API route passes through tenant filtering. There is no “admin bypass” that returns data across tenants.
Audit logs cannot be modified or deleted through the API. The audit log endpoint explicitly rejects DELETE, PUT, and PATCH requests with a 405 Method Not Allowed response:
The audit system uses a circuit breaker pattern. If the database becomes temporarily unavailable, audit events are buffered in memory (up to 500 events) and flushed when connectivity is restored. A per-tenant mutex prevents hash chain forks from concurrent writes.
Each audit log entry includes a SHA-256 integrity hash computed over its contents and the hash of the previous entry, forming a cryptographic chain. Tampering with any record breaks the chain from that point forward.
hash_mismatch — The recomputed hash does not match the stored integrityHash. The record’s contents were modified after creation.
chain_link_mismatch — The record’s prevHash does not match the integrityHash of the preceding record. A record was inserted or deleted in the middle of the chain.
Bulk export of audit logs for regulatory reporting and SOC 2 evidence collection.
GET /api/v1/audit-export
Headers:X-Tenant-Id or session cookie. Requires admin role. Rate limited to 10 requests per minute.Query parameters:
Parameter
Default
Description
format
json
Export format: json, csv, or soc2
startDate
—
ISO date string for range start
endDate
—
ISO date string for range end
entityType
—
Filter by entity type
action
—
Filter by action (create, update, delete)
limit
10000
Max records (capped at 10,000)
offset
0
Pagination offset
The csv format returns the export as a downloadable file with a Content-Disposition header.You can also verify chain integrity through the export endpoint:
POST /api/v1/audit-exportContent-Type: application/json{ "action": "verify_integrity", "startDate": "2026-01-01T00:00:00Z", "endDate": "2026-03-01T00:00:00Z"}
The DSAR endpoint supports GDPR right-of-access and right-to-erasure requests. DSAR processing is asynchronous — the API accepts the request immediately and processes it in the background via a job queue.
Replaces field values with a one-way cryptographic hash. Useful for pseudonymization where you need consistent identifiers without exposing the original value.Configuration:
Fields to Hash — One or more source fields to hash
Algorithm — SHA-256 (recommended), SHA-512, or MD5
Applies pattern-based masking that preserves partial information for operational use while hiding sensitive details. Masking patterns are applied automatically based on detected data formats:
Data Type
Before
After
SSN
123-45-6789
***-**-6789
Email
user@example.com
u***@example.com
Phone
(555) 123-4567
(***) ***-4567
Configuration:
Fields to Mask — One or more source fields to apply masking to
POST /api/v1/admin/retention-configsContent-Type: application/json{ "dataClass": "interactions", "retentionDays": 365, "legalHold": false}
Parameters:
Field
Required
Description
dataClass
Yes
One of: interactions, decisions, metrics, audit
retentionDays
Yes
Number of days to retain (1 to 36,500)
legalHold
No
When true, prevents automatic purging regardless of retention period
Data classes:
Class
What It Covers
interactions
Customer interaction history and response records
decisions
Decision trace records from the recommendation engine
metrics
Behavioral metrics and pipeline execution metrics
audit
Audit log entries (subject to legal hold considerations)
Retention policy changes are themselves audit-logged with action retention_config.upsert (or retention_config.legal_hold when a legal hold is applied).
Connector credentials — The authConfig field on connector records stores sensitive connection parameters (passwords, API keys, access tokens). These are stored as encrypted JSON in the database.
API keys — Platform API keys (krn_ prefix) are validated against hashed values in the database.
KaireonAI supports compliance with India’s Digital Personal Data Protection Act, 2023 (DPDPA), which governs the processing of digital personal data of Indian residents. Penalties for non-compliance can reach up to INR 250 crore (~$30M).
The GDPR erasure endpoint (POST /api/v1/gdpr/erasure) deletes the following customer data:
Entity
What’s Deleted
interactionHistory
All impressions, clicks, conversions, dismissals
interactionSummary
Materialized interaction aggregates
suppression
Active contact suppressions
decisionTrace
Decision pipeline execution records
attributionResult
Revenue attribution records
variantAssignment
A/B test experiment assignments
identityLink
Cross-device/cross-channel identity links
journeyEnrollment
Customer journey enrollment records
Dynamic schema rows
Customer data in tenant-defined schema tables
Erasure is permanent and cannot be undone. The operation is audit-logged for compliance evidence. Use the DSAR export endpoint to provide the customer with their data before erasure.
