Enhanced Security
Stronger access controls, runtime threat detection, and an immutable audit trail for all your deployments.
What it is
Enhanced Security is an account-level add-on ($10/month) that applies to every deployment in your account. It hardens the Kubernetes layer your apps run on and provides the documentation trail that compliance frameworks require.
It is designed as a foundation toward HIPAA compliance. If you need a Business Associate Agreement (BAA), contact us.
What's included
Hard exec access controls
Kyper's automated systems are blocked from kubectl exec into your deployment pods via Kubernetes RBAC. This is a technical enforcement, not a policy — there is no configuration toggle that bypasses it. Any emergency access requires deliberate privilege escalation that is recorded in the audit log.
Immutable audit trail
All Kubernetes API calls to your namespaces are logged to write-once object storage with 7-year retention. You can request a full export at any time. This log covers namespace creation, secret access, deployment rollouts, and any privileged operations.
Restricted Pod Security profile
Your deployment namespaces enforce Kubernetes' Restricted Pod Security Standard (the strictest built-in policy). This prevents workloads from running as root, requesting host-level access, or using privilege escalation paths through pod configuration.
Kubernetes audit logging
All Kubernetes API server calls to your namespaces are captured in the cluster audit log, providing a tamper-evident, timestamped record of every API action taken against your resources — including reads.
Runtime threat detection
Falco monitors kernel-level syscalls across your deployments at runtime. Suspicious behavior — unexpected shell spawns, file writes to sensitive paths, unusual network connections — triggers alerts that are routed to our security team and logged in your audit trail.
What it doesn't cover
Not zero-knowledge. Your deployed application reads its own data in plaintext at runtime. Enhanced Security limits who can access that data and records when they try — it does not encrypt data in a way that makes it unreadable to Kyper.
Emergency access exists. A Kyper engineer with elevated cluster-admin credentials could access your data in an emergency. That action would be recorded in the immutable audit log and would require deliberate privilege escalation beyond normal role boundaries.
hooks.on_deploy is not supported. On-deploy hooks require exec access into the running container. With Enhanced Security active, this access is blocked at the RBAC level, so on-deploy hooks are skipped. Use hooks.release (runs as a one-shot K8s Job) instead.
Pricing
$10/month, billed separately from your deployment subscriptions. It applies account-wide — one charge covers all your deployments regardless of how many you run.
You can cancel at any time. Cancellation takes effect at the end of your current billing period; your deployments continue running at the standard security posture after that point.
How to enable
Go to Account → Enhanced Security from the sidebar. Click Enable — $10/mo. You'll be charged immediately and all your deployments switch to the enhanced security posture within a few minutes.
To disable it, click Cancel on the same page. Enhanced Security stays active until the end of your billing period, then reverts to the standard posture.
You can also enable Enhanced Security directly from the subscription checkout page when deploying a new app.