Skip to content

Resources

Security

This page separates two things that are usually run together. What is true of amkit.com, the website can be verified by reading it. What is true of the amkit platform cannot be stated here yet, and is listed rather than claimed.

The website

No third-party script of any kind runs on this site: no analytics, no tracking pixel, no advertising network, no session recording. Every font is served from this domain, so opening a page makes no request to any other company.

Your theme and language preferences are stored in your browser. There are no cookies. The privacy page covers this in full.

The site is served as static files. Nothing on it executes on a server in response to a reader, because there is nothing on it to execute.

Signing in

The authentication service is not live yet. The sign-in controls remain disabled, so this website does not accept or send credentials today. When the service is live, this page has to say how credentials travel, where they are checked, and what is recorded.

Still to be supplied

The platform’s security posture is a customer’s first question and this site cannot answer any of it today. These are the facts only amkit can provide, and this page is not complete until they are here:

  • Where the platform is hosted, in which regions, and whether a customer can choose.
  • Encryption in transit and at rest, and how keys are managed.
  • Tenant isolation: what separates one organisation’s data from another’s.
  • Authentication and access control — single sign-on, multi-factor, session handling, and how roles and permissions are enforced at the data layer.
  • Audit logging: what is recorded, who can read it, and how long it is kept.
  • Backup, retention and the tested recovery objectives.
  • Any certification or attestation held or in progress, with its scope and date.
  • Penetration testing and its cadence, and the results customers can see.
  • Sub-processors, and where each one holds data.
  • Incident response: how a security incident is handled, and how customers are notified.
  • A vulnerability disclosure address, so a researcher has somewhere to write. There is none today.