Built on
Our Own Infrastructure
KyberGate runs on a filtering network we designed and run ourselves, built for one job: keeping students safe without slowing them down. Redundant by design, encrypted end to end, and built so student data stays private and stays in the United States.
Encryption
TLS 1.2+ in transit, AES-256 at rest. All data encrypted end-to-end.
Access Control
Role-based access, MFA support, org-scoped data isolation.
Audit Trail
Every action logged. Full audit history for compliance reviews.
Infrastructure
Purpose-Built Platform
A custom filtering and inspection stack we engineer and operate in-house, hosted in hardened, enterprise-grade US data centers. No shared filtering appliances and no generic off-the-shelf filter engine.
Multi-Region Filtering Network
Dedicated filtering nodes in multiple regions route each device to a nearby, healthy node. Traffic is inspected in memory and never written to disk in decrypted form.
Redundancy & Resilience
Redundant filtering capacity, continuous health monitoring, and backup and disaster recovery, so one failing server never takes a school offline.
Privacy by Design
We collect only what filtering and safety need. Student data is stored in the United States, kept 90 days by default, and is never sold or used for advertising.
Data Isolation
Each school organization's data is logically isolated with strict security rules enforcing org-scoped access. No cross-org data leakage is possible.
Network Security
All endpoints protected by TLS 1.2+. Certificates renew automatically, and every API endpoint requires authentication.
Security Practices
Encryption in transit (TLS 1.2+)
Encryption at rest (AES-256)
Role-based access control (RBAC)
Multi-factor authentication support
Organization-scoped data isolation
Comprehensive audit logging
Automated vulnerability scanning
Dependency monitoring & patching
Incident response plan documented
90-day data retention by default
Secure development lifecycle (SDLC)
Minimal data collection principle
Employee access on need-to-know basis
Regular access reviews
Backup and disaster recovery
Secure API authentication (tokens)
HTTPS Inspection Security
KyberGate's proxy performs HTTPS inspection (SSL/TLS interception) to filter encrypted web traffic. Here's how we keep this process secure:
Per-Org CA Certificates
Each organization gets a unique CA certificate installed via MDM, limiting the scope of trust.
In-Memory Inspection
Decrypted content is inspected in memory and never written to disk. Only URLs and metadata are logged.
Banking & Health Exemptions
Financial institutions and healthcare sites can be exempted from inspection to protect sensitive transactions.
Bypass Domain Support
Schools configure bypass lists for domains that should skip inspection entirely (Apple services, internal sites).
Responsible Disclosure
If you discover a security vulnerability in KyberGate, please report it to security@kybergate.com. We take all reports seriously and will respond within 24 hours. We do not pursue legal action against security researchers who act in good faith.
Questions About Security?
Our team is happy to walk through our security architecture with your IT team or provide documentation for procurement review.