Skip to content
Kennmarq.com, home
Menu

Trust center

What an enterprise checks before it signs, in one place: where your data lives, how keys are kept, who else sees anything, and how you can check us instead of trusting us.

Where data lives

  • Zurich (AWS eu-central-2): everything kept. The database, uploads, durable credentials, the transparency log, the signing keys, and the marker and the time-stamp server, which have no public address.
  • Frankfurt (AWS eu-central-1): the API's front door, behind CloudFront. Requests pass through it in memory on their way to Zurich; it keeps nothing. Database backups are copied here.
  • Ireland (AWS eu-west-1): the status page, checked from outside the service. It holds no customer data.

Images and songs are read in memory for one call and kept nowhere; marked clips wait a day for you to download them. Local mode keeps files on your machine: only a manifest of about 13 KB comes to us. The privacy policy lists everything we keep, and for how long.

Encryption and keys

  • TLS 1.2 or later everywhere: between you and us, and between our services and the database.
  • Storage, the database and its backups are encrypted at rest; secrets are in AWS Systems Manager, encrypted with KMS.
  • Seven keys in AWS KMS, never exported: two roots (P-384), the live and test signing keys, the time-stamp key, the log's key and the checker's key (P-256). Our certificate chains are published.
  • We sign only what a mark of ours would carry: AI source types, our own generator, no thumbnails; a fixed number of signatures per call. Our signature can't be lent to other claims.

Access

  • Each function has its own role with only the permissions it needs.
  • The marker and the time-stamp server have no URL: only the API's role can invoke them, through the AWS API.
  • The database admits the app only with short-lived IAM tokens over verified TLS; no database password exists in the app.
  • Administrative access is one IAM user with multi-factor authentication; the account's root user is kept for account tasks.
  • Your side: organisations with five roles, test and live keys with scopes, IP allowlists, and an audit log that can't be edited, is anchored in the transparency log, and exports as CSV or JSON.

Integrity you can check

Every signature, time-stamp and signed checker result is appended to a public Merkle log, with a root signed every hour while it grows. Anyone can ask for proof that an entry is there and that the log only grows: the transparency log, and its API. It shows we never backdate or quietly sign anything.

Availability

  • The status page checks the site, the API, signing, the log and the checker every minute, from a region the service doesn't run in, with 90 days of history.
  • Marking fails closed: a file that isn't marked exactly as asked is never returned, and nothing is charged.
  • Database: point-in-time recovery for 7 days, with copies in a second region.
  • API v1 is frozen: additions only, and 12 months' notice before anything breaking. Every change is in the changelog.

Software

  • Every dependency is pinned to an exact version, and images to a digest; updates are made on purpose, one at a time.
  • Container images are scanned for known vulnerabilities as they are pushed.
  • Software bills of materials (CycloneDX): the web app and API, and the marker and the time-stamp server.
  • Before each release: the automated tests of each part (some 650) and an end-to-end run against the three services together, with real signatures, time-stamps and watermarks.

Security questionnaire

Short answers to what security questionnaires ask most. Write to us for anything they don't cover.

Who are you?
Angelo Lamonaca (sole proprietorship), trading as Neuramare, a Swiss business in Baar, builds and runs Kennmarq.com, with automated monitoring and alerts around the clock.
Where is customer data stored?
In AWS Zurich (eu-central-2). Database backups are copied to AWS Frankfurt. Nothing is stored elsewhere.
Do you store our files?
No. Images and songs are marked in memory and never stored. Uploads wait in Zurich until they're used, an hour at most, and marked clips for a day, so you can download them.
Is data encrypted?
In transit with TLS 1.2 or later; at rest with AES-256 (database, backups, storage); secrets with AWS KMS.
How are signing keys protected?
Created in AWS KMS (FIPS 140-validated hardware) and never exported; signing is a KMS call, capped per request.
Who can access production?
Only the owner, through an AWS IAM user with multi-factor authentication. Each function's role reaches only what it needs.
Do you use sub-processors?
Three: AWS (hosting), Stripe (payments) and Proton (the email you send us). The list.
Do you have a DPA?
Yes, online, under GDPR Art. 28 and the Swiss FADP, with 48-hour breach notification.
Are you certified?
Not yet (no SOC 2 or ISO 27001 of our own). AWS holds both for the infrastructure; this page and the transparency log are our evidence.
Do you log personal data?
Our logs hold request and key IDs and timings, kept 30 days; no file contents, no IP addresses. The audit log records who changed what in an organisation, with the IP address.
How do we know you sign only what you say?
Every signature and time-stamp goes into a public, append-only transparency log with signed roots. Anyone can check it.
What if you go away?
Marks stay valid and readable without us: C2PA and IPTC are open standards, TrustMark, Video Seal and AudioSeal are open source, and our certificate chains are public.
Backups and recovery?
Point-in-time recovery of the database to any second in the last 7 days, with copies in a second region.
How do you handle incidents?
We restore service first, tell affected customers, and post on the status page; a breach of personal data is notified within 48 hours.

Documents

Our only domain

kennmarq.com is our only domain: we never email you, sign you in or bill you from any other. A site, an email or an invoice that claims to be Kennmarq.com from anywhere else isn't us: don't enter a password or a key there, and tell us at security@kennmarq.com.

Reporting a vulnerability

Write to security@kennmarq.com (also in our security.txt). We acknowledge within two working days and keep you told until it's fixed. If you act in good faith, test only against your own account and data, don't degrade the service for others, and give us reasonable time to fix before you publish, we won't pursue you. We can't pay bounties yet; we credit reporters who want it.