Skip to main content

Security

Kuroco is built to be cloud-native and designed with security in mind.

API​

  • Fully encrypted HTTPS communication
  • TLS certificate
  • Custom domain settings
  • Web Application Firewall (WAF)
  • CDN
  • DDoS protection
  • Access control through fixed tokens, dynamic tokens, and/or cookies
  • Flexible CORS configuration
  • Strict permissions control via user group settings
  • IP address access restrictions
  • Access logs (audit logs)
  • Application logs
  • External login integration via SAML/OAuth/IDaaS
  • Access control using client certificates (optional)
  • Fastly DDoS Protection applied (optional)

Management screen​

  • Fully encrypted HTTPS communication
  • TLS certificate
  • Web Application Firewall (WAF)
  • DDoS protection
  • Access restriction by ID & password (see Login policy for password policies and login lock)
  • Strict permissions control via user group settings
  • IP address access restrictions
  • Encrypted storage of sensitive information such as access tokens via Secrets
  • Access logs (audit logs)
  • Application logs
  • Two-factor authentication via one-time passwords (Authenticator(TOTP), Email, SMS) and passkeys
  • External login integration via SAML/OAuth/IDaaS, and automatic member synchronization via SCIM
  • Access control using client certificates (optional)
  • Three-layer control of admin operations from MCP clients via Admin MCP

KurocoFront​

  • Fully encrypted HTTPS communication
  • TLS certificate
  • Custom domain settings
  • CDN
  • DDoS protection
  • BASIC authorization
  • IP address access restrictions
  • Access logs

KurocoFiles​

  • Fully encrypted HTTPS communication
  • TLS certificate
  • CDN
  • DDoS protection
  • Strict permissions control via user group settings
  • IP address access restrictions
  • Access logs

※In addition to KurocoFiles, it is possible to restrict access to files based on user authentication using Google Cloud Storage and Amazon S3.

Login policy​

For login to the admin panel, you can configure two-factor authentication (authentication code and passkey), login lock, and password policies (expiration, length, reuse of past passwords, etc.) under "Login" in [Environment] -> [Site settings].

note

The authentication code and passkey settings only apply to login to the admin panel. On the API side, configure the setting for each API.

Logs​

Backup​

  • Per site: create manual or automatic (once a day) backups on the Backup screen
  • Infrastructure: a full backup of the entire Kuroco platform is executed once a day and stored for 5 days (5 generations). A full rebuild drill of the infrastructure has been carried out
  • If per-site backups are not configured, for example, customer data can be extracted from the infrastructure backup and restored as an optional paid service (330,000 JPY per request, tax included)

For details, see Documents on infrastructure.

Admin MCP​

Operations available through Admin MCP are controlled at three layers: the endpoint URL, the OAuth client scopes, and the authenticated member's permissions. Combined with proxy login, you can delegate permissions to a member dedicated to an AI agent with narrowed permissions.

Deployment types and data centre​

Deployment typePlatformPlatform's ISMAP registration status
Public SaaSGCP (with Fastly)GCP is ISMAP-registered
Private SaaS (Managed)AWSAWS is ISMAP-registered
Private SaaS (Self-Hosted/BYOC)AWSAWS is ISMAP-registered
  • For the Public SaaS edition, you can choose the GCP Tokyo, EU, or US region when you start using the service
  • The Private SaaS edition can be built according to your requirements. You can also choose whether to use Fastly (not ISMAP-registered), which is used as the CDN
note

Kuroco itself is not registered with ISMAP as a SaaS. The Private SaaS edition can be configured using ISMAP-registered AWS.

For details, see Is Kuroco compliant with ISMAP (Information system Security Management and Assessment Program)? and Is an on-premises version available?.

Redundancy and disaster recovery (DR)​

  • The Public SaaS edition runs across 3 AZs, and the Private SaaS edition across 2 AZs (standard configuration)
  • Backups of environments in the Tokyo region are stored in the Osaka region
  • For the Private SaaS edition, a hot-standby environment in the Osaka region is available as an option

For details, see Disaster Recovery (DR).

Managing company (Diverta Inc.)​

Vulnerability assessment​

  • Vulnerability scan of containers at every container update (almost daily)
  • Vulnerability assessment using VAddy (standard APIs of the representative site only). Customized APIs on customer sites can also be assessed through automatic integration with VAddy, available upon request via the admin panel
  • Vulnerability investigation using Daybreak Blue in OpenAI Daybreak
  • Application pending for Anthropic's Cyber Verification Program
  • Free support for important Kuroco-derived issues identified in individual vulnerability assessments

Security settings review​

  • With Admin MCP and kuroco-security-audit in Kuroco Skills, an AI agent can check whether your Kuroco security settings follow best practices and create a report (settings are not changed)
  • In the paid Kuroco Configuration Security Assessment, the Kuroco team reviews your settings, reports risks and remediation guidance, and also supports fixing the settings

Both review configuration values and do not include vulnerability scanning or penetration testing.

Checklist​

The following security checklists can be provided. If you wish to receive them, please contact our support team.

  • "Security Implementation Checklist" supervised by Information-technology Promotion Agency, Japan (IPA)
  • "SLA Guidelines for SaaS (Kuroco version)" published by the Ministry of Economy, Trade and Industry (METI)

Filling in your own security checklist is a paid service (from 55,000 JPY, tax included, per request). For details, see Can you audit my security checklist? (for clients based in Japan).

Security Evaluation Platform​

We also respond to investigations on the third-party security assessment platform "Assured" (a separate contract with Assured is required). Our security evaluation is 96.6 / 100 (top 5%).

Documents​

Support

If you have any other questions, please contact us or check out Our Slack Community.

Contact form
Join Kuroco Slack community