Trust and security
What we enforce technically, what we check before every release and what we deliberately do not claim.
In short
Static architecture, strict security headers, no runtime dependencies, a release manifest with SHA-256 and a 32-stage gate before every release, including axe-core and html-validate.
Architecture
KYA is a static website without server logic. Verification runs as a JavaScript module in the browser; there is no account, no database, no cookies and no analytics tools. Delivery runs through Vercel's edge network.
Security headers
| Header | Value | Effect |
|---|---|---|
Content-Security-Policy | default-src 'none'; script-src 'self'; connect-src 'none'; form-action 'none'; frame-ancestors 'none' … | Own scripts only, no network connections from the page, no framing |
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload | Encrypted connections only |
X-Content-Type-Options | nosniff | No content-type sniffing |
Referrer-Policy | strict-origin-when-cross-origin | No paths to other sites |
Permissions-Policy | camera=(), microphone=(), geolocation=() … | No device access |
Cross-Origin-Opener-Policy | same-origin | Isolation from foreign windows |
The headers are part of the repository and are automatically tested against the site on every release.
Supply chain and release integrity
- No runtime dependencies; build tools are pinned to exact versions and installed against the lockfile.
- Every delivered file is listed with SHA-256 in the public release manifest.
- The delivery package carries checksums for every file; setup aborts on any mismatch.
- Test vectors demonstrably contain no private key material.
Checks before every release
No release without a green gate. It comprises 32 stages, including type checking in the strictest mode, 62 test vectors and 24,000 fuzz mutations, reconciliation of the verification profile with the engine, language parity, link and structure checks and end-to-end tests in Chromium under the production CSP with layout stability measurement.
Independent tools add to this: axe-core checks every page at two widths against WCAG 2.2 AA, html-validate the HTML structure, Vercel's own routing logic the headers and redirects. The command line is tested against all vectors, and in testing the site also runs on a third-party web server without network access.
Privacy
Evidence does not leave the browser. The host processes technically necessary connection data; we do not analyze it. To the privacy policy
Accessibility
The target is WCAG 2.1 level AA. Automatically checked: every page with axe-core at desktop and mobile width, color contrast of all text and status combinations, labels on all form fields, keyboard navigation with skip link, image alternatives, free zoom and reduced motion. Please report barriers to info@innopulse.io.
Reporting vulnerabilities
Please report confidentially to info@innopulse.io. The machine-readable details are in security.txt. We confirm receipt and inform you about the next steps.
What we deliberately do not claim
- KYA holds no certification.
- KYA is not an accredited trust service.
- Whether a timestamp is qualified is not determined without an official trust list.
- Results are technical statements, not legal advice.