Privacy & Zero-PII Data Protection Policy.

1. Privacy Philosophy & Zero-PII Architectural Commitment

KyoRox ("KyoRox", "we", "us", or "our") is engineered from the ground up on a Zero-PII Stateless Volatile RAM principle. Unlike legacy identity clouds that store millions of corporate employee email addresses and profile records in persistent vendor databases, KyoRox processes end-user SAML 2.0 assertions strictly in volatile memory and never writes end-user personal data to disk.

This Privacy Policy governs all KyoRox web properties and endpoints, including our public pages (/, /pricing, /features, /integrations, /status, /trust, /changelog, /customers, /docs, /welcome, and /contact), the Customer Control Plane (https://kyorox.com/dashboard), and our production SAML 2.0 to JWT gateway (https://sso.kyorox.com).

2. End-User SAML Authentication Data (100% Volatile RAM — Never Stored)

When your enterprise customers' employees authenticate through KyoRox via Okta Workforce Identity, Microsoft Entra ID (Azure AD), Google Workspace, JumpCloud, PingIdentity, or Custom OASIS SAML 2.0 providers, KyoRox acts strictly as a stateless cryptographic protocol conduit:

• Sub-15ms Volatile RAM Execution: Incoming SAML 2.0 XML assertions (containing attributes such as NameID, email, firstName, lastName, and group/role claims) are parsed, cryptographically verified against the tenant's IdP X.509 certificate, and normalized into a signed RFC 7519 HS256 JWT exclusively inside volatile system RAM.
• Immediate Memory Garbage Collection: The moment the HTTP 302 redirect handoff is dispatched to your whitelisted allowed_redirect_uris callback endpoint, the volatile memory buffer is released and garbage-collected.
• Zero Disk & Log Persistence: KyoRox writes 0 bytes of end-user personal data to any database table or persistent disk log. Automated log redaction filters strip email, NameID, and access_token values prior to any operational telemetry output.

3. Business Customer & Tenant Configuration Data We Collect

To provision and operate your organization's isolated B2B workspace, KyoRox stores only the minimal technical configuration metadata required for multi-tenant routing:

• 1. Workspace Administrator Email Address: Provided during subscription checkout and used strictly to dispatch initial Welcome Credentials, authenticate ownership during Control Plane Email Verification / Credential Recovery, deliver proactive X.509 Certificate Expiry Alerts, and respond to engineering support inquiries.
• 2. Cryptographic Workspace Identifiers: Your isolated Tenant UUID (UUID v4), an irreversible one-way SHA-256 digest of your Live API Key (plain-text API keys are never stored), and your AES-256-GCM encrypted 256-bit JWT Client Secret (sealed with a unique 96-bit IV and 128-bit Authentication Tag).
• 3. Public SAML Federation Metadata: Your configured IdP Provider type, IdP Entity ID, IdP Single Sign-On URL, whitelisted HTTPS allowed_redirect_uris, and encrypted IdP X.509 public signing certificate (.pem) along with its parsed expiration timestamp (cert_expires_at).

4. 300-Second Ephemeral Nonce Replay Protection

To protect your downstream application against Man-in-the-Middle (MitM) SAML assertion replay attacks, KyoRox temporarily caches only the opaque cryptographic SAML Assertion Identifier (AssertionID / InResponseTo nonce string—which contains zero personal or identifying user data) in volatile memory with a strict 300-second (5-minute) automatic expiration TTL. Once the 300-second window elapses, the nonce is automatically purged from memory.

5. Email Verification, Credential Recovery & Transactional Alerts

Your registered workspace administrator email address is used exclusively for high-security transactional communications:

• Post-Checkout Provisioning: Instant delivery of your initial Tenant UUID, one-time Live API Key (kx_live_...), and 256-bit JWT Client Secret.
• Control Plane Email Verification & Recovery: Dispatching time-bound 6-digit One-Time Passcodes (OTP) when you initiate self-serve credential recovery or atomic API key rotation inside https://kyorox.com/dashboard.
• Proactive X.509 Certificate Expiry Radar: Automated 30, 14, and 7-day pre-expiry notifications warning your team before an enterprise IdP signing certificate expires.
• Zero Marketing Spam: KyoRox never sells, rents, trades, or shares customer email addresses with data brokers or third-party advertisers.

6. Cookie-Free Architecture & Tab-Scoped sessionStorage

KyoRox operates a strict cookie-free privacy posture across both our marketing website and authentication gateway:

• Zero Tracking or Advertising Cookies: We do not deploy third-party advertising pixels, cross-site behavioral trackers, or persistent browser cookies on kyorox.com or sso.kyorox.com.
• Ephemeral Tab-Scoped Control Plane Custody: When you log into the Customer Control Plane (/dashboard), your active workspace credentials are held strictly in browser tab-scoped window.sessionStorage (never in persistent localStorage or cookies) and are automatically wiped the moment you close the browser tab or click Logout.

7. Payment Processing, Tax Compliance & Merchant of Record (Lemon Squeezy)

All subscription checkouts across our Starter ($39/month), Growth ($139/month), and Enterprise ($349/month) tiers—including payment card processing, fraud prevention, invoicing, and local indirect tax (VAT, GST, or US State Sales Tax) calculation—are processed directly by our authorized Merchant of Record, Lemon Squeezy:

• Zero Payment Card Custody at KyoRox: KyoRox never receives, processes, inspects, or stores your raw credit card numbers, CVV security codes, or bank account credentials on its infrastructure.
• Webhook Provisioning Metadata: Upon successful checkout or renewal, Lemon Squeezy transmits an HMAC-SHA256 signed webhook containing only your billing email address, subscription status, and plan tier identifier so KyoRox can provision or update your tenant connection quota.
• Billing & Tax Governance: For complete details on how checkout taxes, B2B reverse-charge tax exemptions, and subscription refunds are handled, review our Refund, Billing & Checkout Tax Policy (/refund).

8. Cryptographic Security Measures & Tenant Isolation

KyoRox enforces defense-in-depth cryptographic controls across every layer of our identity proxy and Control Plane:

• TLS 1.3 In-Transit Encryption: All SAML 2.0 assertion posts, metadata exchanges, and Control Plane API calls are encrypted in transit over strict HTTPS/TLS 1.3 with HSTS preload enforcement.
• FIPS-197 AES-256-GCM Vault At Rest: Tenant 256-bit JWT Client Secrets and uploaded IdP X.509 certificates are encrypted at rest using AES-256-GCM with unique 96-bit initialization vectors (IVs) and 128-bit authentication tags.
• Constant-Time SHA-256 Key Verification: Tenant API keys (kx_live_...) are stored exclusively as irreversible SHA-256 hashes and verified using constant-time byte comparison to prevent timing side-channel attacks.
• Strict Anti-IDOR & XML Hardening: Every database query enforces composite tenant isolation (tenant_id + connection_id), and every incoming SAML XML payload is pre-screened against XML External Entity (XXE), DTD expansion, and XML Signature Wrapping (XSW) attacks. Explore our full security architecture at /trust and /security.

9. Data Retention, Self-Serve Deletion & Account Termination

We retain B2B workspace configuration metadata only for as long as your subscription remains active:

• End-User Authentication Claims: Retained for 0 seconds on disk (processed strictly in volatile RAM and discarded immediately upon JWT redirect handoff).
• Self-Serve Connection Deletion & Key Rotation: You have 24/7 self-serve control inside https://kyorox.com/dashboard to permanently delete any configured SAML 2.0 IdP connection or rotate your API key and JWT signing secret at any time.
• Account Cancellation, Refund, or Erasure Request: Upon subscription cancellation, refund (/refund), or a verified written erasure request sent to support@kyorox.com, your tenant workspace, API key digest, and encrypted IdP records are deactivated and purged.

10. GDPR, CCPA & International Data Protection Rights

Under the European Union General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and equivalent global privacy frameworks:

• Sub-Processor Exemption for End-User Employee PII: Because KyoRox never stores end-user employee emails, names, or attributes on disk, enterprise customers avoid the third-party database residency and right-to-erasure backlogs associated with traditional identity brokers.
• B2B Customer Data Rights: Workspace administrators have the right to request access to, rectification of, portability of, restriction of processing for, or permanent erasure of their B2B account metadata at any time—without discrimination—by emailing support@kyorox.com.

11. Privacy Officer & Support Contact Information

If you have questions regarding this Privacy Policy, require architecture verification for an enterprise InfoSec review, or wish to exercise your GDPR/CCPA data rights, contact our Privacy & Systems Engineering Desk directly.