Skip to main content

Security and deployment

Security and deployment options, from hosted cloud to air-gapped networks

Kinetic runs where your security rules say it must: in Kinetic's cloud, in your own data center or cloud account, or on an air-gapped network. People sign in with SAML or OIDC single sign-on, or with CAC and PIV cards. Roles control access, every action is logged, and your AI model can run inside the same boundary.

Book a working session

Army INSCOM A CAC-authenticated recruiting portal in a DoD IL5 environment cut weekly recruiter admin time from 25 hours to 12.5. Read the INSCOM case study

The Kinetic console Security Definitions list for an application, including Admins, Authenticated Submissions, City Staff, City Staff Form, Data Steward, Everyone, Immutable, Registrant or Staff and Staff or Own Record, each typed as Kapp, Form or Submission.
Access rules are defined per application, per form and per record, in the console. City of Cedar Harbor · fictional organization, sample data

Three ways to run Kinetic, and the same platform in each

Pick the deployment that fits your environment. The experience, workflow and integration layers do not change between them.

  • Run by Kinetic Data

    Kinetic-hosted cloud

    We operate and patch the platform. The quickest route to a first application, with no infrastructure for your team to run.

  • In your data center or cloud account

    Customer-managed

    You run Kinetic inside your own environment, usually because data residency or an existing authorization boundary requires it.

  • On networks with no outside connection

    Air-gapped

    Kinetic runs with no external dependencies, updates arrive through your own offline transfer process, and if you use AI steps, the model runs on the same disconnected network as everything else.

People sign in the way they already do, and see only what their role allows

Your identity provider handles sign-in. Kinetic's roles handle everything after it.

  • Single sign-on

    SAML and OIDC, so people sign in through Entra ID, Okta or whichever identity provider you already run.

  • CAC and PIV cards

    Government users sign in with a Common Access Card or a Personal Identity Verification card.

  • Roles

    Roles decide who sees each portal, who can change each workflow and which systems a connection can reach.

  • Separation of duties

    A workflow can require that the approver is not the requester, and records who did what.

Defense and intelligence

Running with ATOs in DoD IL4 and IL5 environments

Kinetic Data has 20+ years serving defense and intelligence. Kinetic has been deployed in DoD Impact Level 5 environments, including for Army INSCOM's recruiting portal.

Defense customers authorize Kinetic inside their own boundary. Several that offered to sponsor a FedRAMP authorization decided it was faster to install Kinetic in their own GovCloud environment, scan its containers and issue an Authority to Operate themselves. Kinetic runs with ATOs in DoD IL4 and IL5 environments today. In a security review we show your team the architecture, how data moves through it and how comparable defense deployments were set up.

Kinetic holds as little of your data as it can

It reads from and writes to your systems instead of copying them. What it does hold is encrypted and logged.

  • Encryption

    Data is encrypted in transit between Kinetic and your systems, and at rest.

  • Credentials kept out of workflows

    Connection credentials are stored encrypted and managed by your administrators. Workflows refer to a connection; they never contain the password.

  • A record of every action

    Submissions, workflow steps, system calls and approvals are logged, so any request can be traced from start to finish.

  • Separate tenants

    One deployment can serve several agencies or business units, each with its own data, users and configuration.

Models

AI runs on the model you approve, inside your boundary

Kinetic does not ship a model. Customers use Anthropic Claude, Amazon Bedrock, Azure OpenAI, open models on their own hardware, or any model that supports MCP. On an air-gapped network, the model sits on that network too.

AI does

  • Run as a workflow step on the model you configure, receiving only the fields that step passes.
  • Build and start work through MCP under the signed-in user's roles, like any other user.

AI does not

  • Call a model Kinetic Data chose for you. There isn't one.
  • Get around roles, or approve the steps you have assigned to a named person.

See how these controls fit the three-layer platform architecture and the integration layer's connections and APIs.

What you can build next

Once Kinetic is through your security review, the next application runs on the same deployment, sign-in and roles.

Frequently asked questions

Answered by Kinetic Data. Last updated .

  • Can Kinetic run fully air-gapped?

    Yes. Kinetic has no external network dependencies, and updates are applied through your offline transfer process. If you use AI steps, the model runs on the same network, and Kinetic calls it the same way it would call a hosted model.

  • Does Kinetic hold an IL5 authorization?

    IL5 authorizations belong to a specific deployment and the agency that grants them, not to a product. Kinetic runs with ATOs in DoD IL4 and IL5 environments, Army INSCOM among them. In a security review we walk through the scope that would apply to yours.

  • How do agencies authorize Kinetic? Is it FedRAMP?

    DoD customers authorize Kinetic inside their own boundary. Several offered to sponsor a FedRAMP authorization and decided it was faster to install Kinetic in their own GovCloud environment, scan its containers and issue an Authority to Operate (ATO) themselves. Kinetic runs with ATOs in DoD IL4 and IL5 environments today.

  • Does our data leave our boundary when Kinetic uses AI?

    Only if you choose a model outside it. Each AI step calls the model you configure and sends only the fields that step is set up to pass. With a self-hosted model, the data stays on your network.

  • Which identity providers work with Kinetic?

    Any provider that supports SAML or OIDC. Entra ID and Okta both work. Government users can also sign in with CAC or PIV cards.

  • Can one deployment serve several agencies or business units?

    Yes. A state can run one deployment for a dozen agencies, with each tenant keeping its own data, users, configuration and access rules while the platform and its upgrades are shared underneath.

Bring one process. Leave with a plan to build it.

Two hours with our team, at no cost. Bring your security architect and one process. We walk through deployment, sign-in and where your model would run, and send you a written plan afterward.

Book a working session