Security and data
Where your data lives, how runs are isolated, what model providers see, retention and the DPA.
kanman works on your source code. These pages explain plainly what that means for your data and your compliance work.
Trust pack for security reviews
What kanman is and is not, where data flows, who processes it, what is logged, how people stay in control, and how kanman aligns with ISO/IEC 42001 and the NIST AI RMF.
Hosting and data residency
Where kanman runs, where your data is stored, and how to keep code execution on your own infrastructure.
EU-only processing
One switch that keeps every model call of your workspace inside the EU: kanman refuses any other route before a request leaves.
Sandbox and secrets
How runs are isolated, what the coding agent may touch and reach on the internet, how kanman keeps secret values out of runs, treats outside text as data and checks new dependencies.
How kanman marks its work
Every commit, pull request, merge request and tracker comment kanman writes says that it was prepared by AI.
What model providers see
Which language model providers receive data during a run, what they receive, and how to use your own contract.
Retention and deletion
How long kanman keeps runs, evidence and audit entries, and what happens when you delete a team or a workspace.
DPA and subprocessors
The data processing agreement for kanman, where to find the current list of subprocessors, and how changes are announced.