Built to hold the keys
to your clients' kingdoms.
IT documentation is a high-value target. Here's exactly how Knowpoint protects it, in plain language, with the technical detail in the whitepaper.
Encrypted secrets
Passwords, one-time code secrets and integration keys are encrypted with AES-256-GCM, using a separate key for every workspace.
Isolated workspaces
Each customer's documentation lives in its own database schema, at its own address.
Least-privilege access
22 permissions, custom roles, teams, per-organization access and restrictions on single items.
Strong sign-in
Microsoft 365 single sign-on, two-factor authentication, IP allowlists and rate-limited sign-in.
Audit trail and alerts
Every change, sign-in, reveal, share and export is recorded, with alerts for unusual activity like mass password reveals.
Secure sharing
Send a password to a vendor with a link that expires, needs an emailed code or passphrase, and can't be opened without the key in the link.
Private AI
Ask AI only reads what the asking person can see, and never sees password values.
Audited infrastructure
Hosted on Render's SOC 2 Type II and ISO 27001 audited platform, behind Cloudflare.
How your passwords are protected
Every stored password, one-time code secret, integration credential and API key for an AI provider is encrypted by Knowpoint itself, before it reaches the database. That's on top of the hosting provider's encryption of the disk.
- AES-256-GCM, authenticated encryption with a fresh random nonce for every value, so tampering is detected.
- A separate key for every workspace, derived with HKDF-SHA256 from a master key. One workspace's key can't decrypt another's.
- Keys never sit next to the data. The master key lives in the hosting platform's secret store, never in the database, its backups or the source code.
- Every reveal is recorded. Showing or copying a password writes to the audit log, and can raise an alert.
Who holds the keys?
- Master key
- Held by Knowpoint in the hosting platform's encrypted secret store, separate from the database.
- Workspace keys
- Derived from the master key and your workspace's identity when needed, and kept only in memory.
- Your sign-in password
- Never stored. We keep a bcrypt hash, so nobody can read it back, including us.
- API keys
- Shown once when created. Only a SHA-256 hash is stored.
- Customer-managed keys
- Not available yet. Knowpoint manages encryption keys for every workspace.
Control who sees what
Security features your clients will ask about, included for every user.
🔑 Sign in with Microsoft 365
Single sign-on with Microsoft Entra ID, limited to your own directory. Require it for everyone, with password sign-in kept for admins if you choose.
📱 Two-factor authentication
Authenticator-app codes for every account. Sign-in and code attempts are rate-limited per address.
🌍 IP allowlist
Only allow your offices and VPN to reach the workspace and, optionally, the API. You can't lock yourself out by accident.
🛡️ Roles and teams
Built-in and custom roles from 22 permissions, teams, and access limited to chosen organizations.
🔒 Restricted items
Limit a single password, asset or document to named people or teams, with view or edit access.
📜 Audit log and alerts
Every change, sign-in, reveal and export. Get alerts in the app, by email, in Slack or Teams, or as a PSA ticket.
Audited infrastructure
Knowpoint runs on providers with independent security audits. Each workspace has its own isolated database schema and its own address.
| Provider | What it does | Data it handles | Its attestations |
|---|---|---|---|
| Render | Application hosting and the managed PostgreSQL database | All workspace data | SOC 2 Type II, ISO 27001 |
| Cloudflare | DNS, TLS and traffic protection in front of the application | Traffic in transit | SOC 2 Type II, ISO 27001 |
| Resend | Sending email (invites, password resets, alerts) | Email addresses and email content | SOC 2 Type II |
Attestations are those each provider publishes. Knowpoint relies on them for the infrastructure it runs on; Knowpoint itself has not yet completed its own SOC 2 audit.
Security is shared
What we look after, and what's in your hands.
Knowpoint looks after
- Encrypting secrets and keeping the keys away from the data
- Isolating each workspace's data
- Patching and running the application and its dependencies
- Choosing audited hosting, DNS and email providers
- Recording security-relevant activity in your audit log
You look after
- Who you invite, and the roles and access you give them
- Turning on SSO, two-factor and the IP allowlist
- Setting up alerts and reviewing the audit log
- Storing exports safely, especially ones with password values
- Removing people who leave your company
Questions security teams ask
Can Knowpoint staff see my passwords?
Password values are encrypted in the database, and the console we use to run the service shows workspace status and usage, not your documentation or passwords. Because the service decrypts passwords for your signed-in users, the systems that run it can technically do so. Production access is limited to Knowpoint's operators. For account recovery, the console can issue a one-time setup link to a workspace's owner, and doing so is logged.
Are you SOC 2 certified?
Knowpoint is hosted on Render, whose platform has a SOC 2 Type II report and ISO 27001 certification, behind Cloudflare (SOC 2 Type II, ISO 27001). Email goes through Resend (SOC 2 Type II). Knowpoint itself hasn't completed its own SOC 2 audit yet. The whitepaper describes our controls in detail.
Can I bring my own encryption key?
Not yet. Today Knowpoint manages the keys, with a separate derived key for every workspace.
Does the AI see our passwords or train on our data?
AI is off until an admin turns it on. It only reads documentation the person asking can see, and password values are never sent to it. It runs on your own Anthropic or OpenAI API key, so requests go to your account with that provider, under your agreement with them. Under their commercial API terms, your data isn't used to train their models by default.
What happens to our data if we leave?
Export everything at any time, as JSON and spreadsheets. When a trial ends, the workspace is paused, never deleted. If you ask us to delete a workspace, its database schema is dropped, and the hosting provider's backups expire on their normal schedule.
How do I report a vulnerability?
Email security@knowpoint.io with the details and how to reproduce it. Please give us a chance to fix it before telling anyone else. We'll reply, keep you updated, and credit you if you'd like.
Everything your security review needs
The whitepaper covers encryption, keys, access control, isolation, logging, AI and our providers.