If you’ve been through an ISO audit, you know the certification itself isn’t the hard part. The hard part is building the practices. We’d been operating with most of these controls for a while. The certification process was really about documenting what we already do, building processes that scale, and closing gaps.
Some of the most useful things that came out of it: we got clearer on what risks to keep an eye on, ran tabletop exercises that have already helped us respond to issues faster, tightened up vendor management, and got the whole team more involved in security practices. a strong foundation is in place now, and it’ll evolve as Kernel grows.
regulated workflows run on KERNEL
most healthcare information systems don’t have APIs, which makes browser automation the best way in. that means a lot of PHI flows through Kernel. for example, Felicity runs agents on Kernel that interact with electronic health records, referrals, and patient charts. we see this across regulated industries. Effective AI uses Kernel inside insurance carriers’ underwriting, claims, and policy systems, handling policyholder records and financials.
we’re also HIPAA-compliant and sign BAAs with customers who need them, including during trials. a BAA means Kernel is contractually on the hook for safeguarding PHI to HIPAA standards, and your compliance team has the documentation to prove it.
what’s next
Looking ahead, the rollout of frontier cyber models like Mythos has shifted the security and threat landscape beneath our feet. we’re continually looking for ways to strengthen our posture with that in mind. Specifically, we’re investing in scaling our capabilities around vulnerability remediation, detection and response, access control, and segregation within our platform.
You can view our ISO 27001 certificate, our policies, and our full security posture at trust.kernel.sh, or learn more about our security practices at kernel.sh/security.
