Security Overview

This article describes Kentik's security posture for its systems and customer data, and provides links to current security resources, certifications, and detailed technical references.

Security Resources

Compliance and Legal

The following compliance and legal resources are available to current and prospective customers:

• Kentik Security Overview & Whitepaper

• Kentik Trust Center

• Trust Center FAQ

• Subprocessors Disclosure

• Data Protection Agreement

• System and Organization Controls 2 (SOC 2) report (requires NDA)

• Support and SLA

You can also find Kentik uptime, incidents, and status pages at https://status.kentik.com/ (North America) and https://status.kentik.eu/ (EU).

Related KB Articles

Our Knowledge Base (KB) contains many pages with content that may interest security practitioners, including:

• Authentication & Single Sign-On (SSO) management

• Audit Log overview

• Access Control and IP allowlisting

• Credentials Vault design

• Role-based access control (RBAC)

• Threat Feed enrichment of IP data

• Cloud Provider account monitoring

• Universal Agent design and encryption

• AI Advisor and Model Context Protocol (MCP) Server support

• Security and Privacy Overview

• Our V6 APIs (gRPC)

• Recent Release Notes

• DDoS Protection features

Security Summary

When you partner with Kentik, you trust us with metadata and device information from your private networks. Kentik's systems protect that information.

Key features include:

• Multiple ways to encrypt data in transit, including legacy data types such as UDP protocols, early SNMP versions, et cetera.

• Encryption of all customer data stored by Kentik (public, private, and on-premises) using AES-256.

• Strict access protection to all Kentik systems.

  • Kentik technical staff connect over VPNs, authenticate with SSO, connect from a corporate-issued laptop, and use hardware security tokens (e.g., Yubikeys) for infrastructure maintenance.

  • Support for customer single sign-on integrations via SAML 2.0 and multi-factor authentication (MFA) enforcement, with time-based one-time password (TOTP).

  • MFA is limited to TOTP tokens (e.g., Google Authenticator) and hardware-based tokens (e.g., Yubikeys) to protect against phishing and takeover attempts.

    Note: For more about SSO integrations, see About SSO.

• Kentik completes annual SOC 2 (type II) audits, penetration testing, and continuous membership in a bug bounty program. Audit reports and penetration test results are available from our Trust Center under NDA.

• Kentik logically segregates customers in the multi-tenant system, with customer-specific databases used to increase the level of segregation for NetFlow data.

• You have access to detailed security audit logs, including authentication and access events, in the Audit Log. You can search, filter, and export audit log data from within the system.

• Our default service level agreement (SLA) for uptime is 99.9%. Downtime, service degradations, or maintenance are reported on a public-facing status page at https://status.kentik.com (US) and https://status.kentik.eu (EU).

  Note: Read more about our support and SLA commitments in our Support and Service Level Agreement.

The following sections describe how Kentik protects the system and data:

Security Details

The following tables contain frequently requested information by prospective customers to assess security concerns.

Compliance

Current compliance-related information:

Data Types

The categories of data that Kentik does and does not collect and store:

Data Handling

The following table describes how Kentik handles collected data, and where it is processed:

Infrastructure Security

Information related to security on production servers (application and database):

Security Monitoring

Information on security-related monitoring:

Security Methodology

Information about the processes used to ensure the security of the application:

Disaster Recovery

Basic disaster recovery information:

Security FAQ

Kentik's Platform offers scalability, reliability, and security through layered protections. Most customers use our multi-tenant SaaS platform. While this FAQ addresses security concerns in the SaaS environment, many apply to on-premises deployments.

General Security Questions

• Does Kentik hold a SOC 2 Type 2, ISO27001, or similar third-party audit report?
  Yes. Kentik completes annual SOC 2 (type II) attestations and shares audit reports under NDA on our Trust Center. We ensure all data center locations with production systems or customer data maintain strict audit certifications, such as SOC 2, ISO 27001, and similar.

• Has Kentik undergone a vulnerability assessment or penetration test of its production environment within the past twelve months?
  Yes. Kentik performs vulnerability assessments covering both internal and public-facing systems on a weekly basis, with other types of continuous monitoring in place for code and container images. Kentik also engages with an independent third-party firm for penetration tests annually, or when significant infrastructure changes occur.

• Are the hosting facilities SOC 2 or ISO 27001 certified?
  Yes. All of our hosting centers are SOC 2 and/or ISO 27001 certified, and most include additional security-and-privacy-focused certifications. You can find certification information from our co-location facilities at Equinix, Summit, and DataBank.

• How does Kentik manage risks?

  Kentik formally evaluates risks using a quantitative methodology aligned with ISO 27001, managed through our compliance management system with executive and security team involvement.

  • Assessments cover risks to privacy, security, data integrity, uptime, business continuity, fraud, and compliance, and are reviewed by independent auditors.

  • Risk assessments occur at least annually and address underlying risks, evaluate compensating controls, and assess residual risks, with treatment plans assigned for any that exceed internal thresholds and acceptance criteria.

  • Treatment options include transferring risks, pursuing mitigation plans, or avoiding risky activities.

• How does Kentik monitor the system for security events?
  Platform events are logged and aggregated in a dedicated platform.

  • Notable events are aggregated into dashboards, with notifications for anomalous activity sent to internal communications or incident response channels, including after-hours paging systems.

  • Certain log types, including access logs, are provided directly to customer admins in-app.

  • Customers can report suspected or confirmed security incidents via email at security@kentik.com, or as otherwise specified in your signed master service agreement (MSA) and data processing addendum (DPA).

• Does Kentik notify customers if their data is involved in a security incident?
  Yes, while our signed MSAs and DPAs should be considered authoritative, we expect to notify customers within 72 hours of a confirmed security incident affecting their data, or as otherwise required by data protection laws. Find our standard DPA here: https://www.kentik.com/pdfs/KentikDataProtectionAddendum.pdf.

• Does Kentik maintain cyber-liability insurance?
  Yes. We maintain cyber liability coverage of at least $5 million, in addition to other business insurance. Kentik can provide a copy of our certificate of insurance (COI) upon request.

• How does Kentik ensure that security concerns are addressed throughout the company?

  Kentik's corporate security measures and security culture are addressed holistically in the Kentik Security Overview PDF.

  • We ensure technical staff are trained on our Software Development Life Cycle (SDLC), including the Open Worldwide Application Security Project (OWASP) Top 10, Security by Design and Privacy by Design principles, supply chain security, and more.

  • We maintain a formal SDLC that ensures all code changes are subject to peer review, manual/automated testing, and various code checks, including Static Application Security Testing (SAST).

  • Our Security department includes a CSO, compliance, privacy, and assurance-focused staff, and technical security experts. Each team member maintains strong ties across the organization to ensure security is considered in various business initiatives.

• Is Kentik's service PCI and HIPAA compliant?
  Kentik doesn't process or store PCI or electronic protected health information (ePHI) data from customer networks, only network metadata, excluding packet contents. If you plan to use Kentik services in a PCI or Health Insurance Portability and Accountability Act (HIPAA) environment, discuss your security and compliance needs with our sales or customer engineering staff.

• Can Kentik work with customers subject to the GDPR?
  Yes. Kentik's privacy program meets General Data Protection Regulation (GDPR) requirements.

  • We minimize personal information processing, provide options to redact IP addresses, use a Data Protection Agreement (DPA) with EU Standard Contractual Clauses (EU SCCs) by default, and are a member of the US Data Privacy Framework (US DPF). We sign similar agreements with all of our subprocessors who may interact with customer data (see Kentik’s Subprocessor Disclosure for details)

  • We offer hosting in Frankfurt, Germany.

  • We help customers meet specific GDPR requirements, such as information correction, deletion, or audits.

  • Kentik doesn't process "sensitive" information under the GDPR. To review a copy of our DPA, see Kentik’s Data Processing Addendum.

Data Protection and Segregation

• How does Kentik keep customer data separate in a multi-tenant system?
  In our public SaaS, customer data is stored with multiple internal system safeguards to prevent data breaches:

  • Kentik Data Engine (KDE) stores customer network data in separate logical databases and tables.

  • Customer access is strictly limited to their databases and tables.

  • Platform data access audit logs record all activity.

  • Kentik's internal access to production systems and infrastructure is limited to users with compelling business needs.

    • They use dedicated VPNs and hardware-based security tokens to authenticate with the relevant infrastructure.

    • Any such access is subject to internal logging and access review protocols.

• Is data encrypted at rest?
  All customer data across all production systems is encrypted at rest using AES-256.

• Is data encrypted in transit?
  Customers can enable encryption for all data sent to Kentik, including by using a proxy agent that gathers and encrypts network information.

  • Private network interconnects (PNIs) keep data from public networks.

  • Kentik processes non-TCP protocols that were historically unencrypted.

  • User access to the SaaS web platform is encrypted using TLS 1.2+. To learn more about using our proxy agent, see Proxy Agent Overview.

• Can data be removed at customer's request and per customer's policies?
  Yes. Kentik retains telemetry data according to the customer's retention period (typically 45 days for full resolution data and 120 days for summarized/derived metrics).

  • Data is automatically deleted upon expiration.

  • If a customer discontinues use of Kentik, we remove their data from our primary systems according to the defined retention period. Plans and Pricing describes the retention periods.

  • Data can also be removed at customer request.

  • Certain data, like device configurations, is retained for the duration of the customer relationship or until deleted by the customer.

• Will customer data be shared with third-party vendors?

  • Kentik never sells or discloses customer data without permission. For certain relationships, Kentik may on occasion seek written consent to use selected or aggregated data for marketing or research purposes, as covered in customer contracts.

  • Kentik uses subprocessors (listed on our Legal page) with limited interactions with customer data. The vendor hosting our support ticketing system, for example, processes any information shared by customers in support tickets.

  • Third-party vendors and subprocessors undergo thorough security assessments and are required to provide security commitments similar to Kentik's. Vendor security controls are reassessed during the duration of services, consistent with SOC 2 commitments. Kentik ensures data is returned and/or deleted at the end of a vendor relationship.

• Are there any interfaces or connections with third-party systems?
  Kentik offers integrations to third-party systems for data and insights management.

  • Customers manage integrations, configuring and authenticating against their accounts.

  • Kentik provides integrations for notification and alerting channels, DDoS mitigation systems, SSO providers, and more (see Integrations).

Access and Identity Management

• What forms of user management features and controls exist in Kentik?

  • Access to the SaaS platform requires corporate VPN connections and hardware tokens for authentication. Infrastructure access rights are strictly controlled with regular internal and external, independent audits.

  • Customers can opt for MFA with TOTP/app-based devices or hardware tokens. Kentik supports SSO via SAML 2.0, giving customers control over authentication.

    • For more information on SSO, see About SSO.

    • For information about configuration of MFA, see Two-factor Authentication.

  • Kentik offers tiered user roles (user, admin, super admin) for customer management. RBAC limits user access based on the least-privilege principle (see Kentik RBAC).

  • API access tokens are generated at the individual account level and can be reset at any time (see API Token).

• Does Kentik offer single sign-on (SSO)?
  Yes. Kentik supports SSO integrations via SAML 2.0 (see About SSO).

• Is multi-factor authentication deployed for "high-risk" environments?
  Yes. Kentik uses MFA to protect its corporate environment and prevent unauthorized access to its platform. We also offer MFA options for customer access to the Kentik SaaS.

• Do you conduct background checks against your employees & contractors (pursuant to local laws)?
  Yes. Kentik performs criminal background checks for all employees and contractors, including international workers, as required by local laws. US checks include reviewing federal, state, and local records.

• Are employees required to sign NDA or Confidentiality Agreements as a condition of employment to protect customer/tenant information?
  Yes.

• What are Kentik's user termination procedures and timelines?

  Kentik staff access is revoked immediately upon termination (24 hour SLA), with this commitment tested during annual SOC 2 audits. Quarterly access reviews are performed for high risk systems.

• What is Kentik's password policy for systems and infrastructure that is used to host customer data?

  SSH access requires secondary MFA using hardware security tokens (Yubikeys).

Application Security Questions

• Does Kentik employ a formal secure development methodology?
  Kentik maintains a formal SDLC and trains technical staff on security expectations, including reviewing the OWASP Top 10, Security by Design (SbD) and Privacy by Design (PbD) principles, supply chain security, vulnerability and dependency management, internal policy requirements, and other security concepts.

• What are your processes for security code review and secure development lifecycle?
  Kentik's formal SDLC includes security tools and automation to mitigate risks of insecure code in production.

  • All code undergoes peer review, automated and manual testing, CI/CD integration checks, and a staged migration from test to production environments.

  • As part of the release process, all code undergoes Static Application Security Testing (SAST), Software Composition Analysis (SCA), and checks for accidentally committed secrets.

  • Continuous monitoring and enhancement ensure alignment with industry best practices. More details are in our SOC 2 report.

• Can engineers push code directly to Production?
  All code changes undergo peer review and tracking in a dedicated project and code management system with attribution, revert support, and protections to enforce SDLC steps and change control processes. Servers are managed via an Infrastructure as Code (IAC) system for secure, repeatable, and protected deployments.

Privacy Questions

• Does Kentik have a Data Protection Officer (DPO)?
  Kentik has a designated individual in security and compliance filling the DPO role. Questions to the DPO are sent to privacy@kentik.com.

• Does Kentik have a breach notification policy?
  Breach notification is part of incident response. Kentik notifies customers of security incidents consistent with relevant data protection law and signed DPAs, typically within 48-72 hours of confirmation.

• How long does Kentik store data?
  Our standard retention period for full resolution flow data is 45 days, with 120 days retention for derived statistics.

  • Customers can negotiate these retention periods in their signed contract.

  • For NMS users, data retention is 3 months or 13 months, depending on the plan tier.

  • Certain data, like device configurations, is stored as long as you're an active customer.

  • Kentik automatically purges data at the end of a designated retention period; customers may also contact our support team to request full account deletion.

• Where are your servers located?
  Our U.S. servers are in Ashburn, VA, and we offer EU hosting in Frankfurt, Germany. You can specify EU hosting when signing, if desired.

• Can customers control access to features in app?
  Yes, with both RBAC and feature flags or admin toggles for specific functionality.

Where to Learn More

For more on how Kentik supports security use cases, see our hub for security use cases, or the security incident response and DDoS protection overviews on the Kentik website. Our network security blog pages have even more details, including the role our AI services play in responding to incidents.