Security
Security and data
We sell cryptographic proof, so security isn't an add-on: it decides how the product is built. This is what we do with your key, your files and your data.
Your key never leaves your browser
Your Kernel ID is created in your browser with an Ed25519 key that can't be exported. Signing happens on your device: our servers only receive the signature and your public key. We don't have your private key and can't recover it.
We check every signature
Before marking a file, the server checks that the signature matches the key you registered and the person who is signed in. If it doesn't, nothing is signed.
What you upload to verify isn't kept
The file is analysed on our servers and deleted as soon as the check ends.
Our own servers, in Spain
Files, the database, sign-in and the analytics run on our own servers. Outside them we only use Cloudflare, to deliver and protect the site, and Brevo, to send emails.
A site without trackers
No advertising or tracking cookies, no third-party scripts, and our own analytics that identify no one. Always encrypted (HTTPS with HSTS), with a content policy that only allows our own domains.
Every change, tested
No change reaches production without automated tests and review, and the mark's robustness is measured with test batteries on real audio and video.
The AI Act and the GDPR
Article 50 of the EU AI Act asks for AI-generated content to be marked. Kernel covers the other half: letting authentic content prove who published it. It helps an organization with transparency, although on its own it doesn't make it compliant. We process personal data under the GDPR: the details are in the privacy policy.
Report a vulnerability
If you find a security flaw, write to [email protected] with the steps to reproduce it. We'll reply and keep you posted on the fix. Please don't access other people's data, don't disrupt the service, and give us reasonable time before making it public. Our security.txt says the same.