Security Practices

The majority of Kamili Toolbox tools process your data entirely in your browser using JavaScript and WebAssembly. Your files never leave your device for these tools. This is the most private and secure approach possible.

All connections to toolbox.kamili.one use HTTPS with TLS 1.2 or higher. We use HSTS (HTTP Strict Transport Security) to prevent downgrade attacks.

For AI-powered tools that require server processing: • Data is transmitted over HTTPS • Processed data is deleted immediately after the response is sent • We do not store, log, or train on your content • Processing is authenticated — only signed-in users can access AI features

• Hosted on Microsoft Azure with enterprise security controls • Regular automated vulnerability scanning • Dependency security updates via Dependabot • Access controls with principle of least privilege • Audit logging for all administrative actions

We implement strict Content Security Policy headers to prevent XSS attacks and restrict which resources can be loaded. Our CSP is regularly reviewed and updated.

If you discover a security vulnerability, please email security@kamililabsllc.com. Please do not publicly disclose vulnerabilities before we have had a chance to address them. We will acknowledge your report within 48 hours and work to resolve valid issues promptly.

We value the security research community. For significant vulnerabilities responsibly disclosed, we offer recognition and, for severe issues, monetary compensation. Contact security@kamililabsllc.com for details.