Identity & permissions
Role-based access, strong authentication, least privilege, joiner/mover/leaver processes, and periodic access reviews.
SECURITY, CONTROL & RELIABILITY
Trust is built into
the operating model.
KinetiPlan is being positioned for customer-hosted environments, with security and operational controls treated as product requirements—not afterthoughts.
Transparency note
This page describes intended design principles, not a certification or a claim that every control is currently implemented. Security posture, testing, and deployment readiness must be verified before production use.
CONTROL AREAS
Plan the controls
before go-live.
Customer-hosted software still requires clear ownership across application, infrastructure, identity, data protection, monitoring, recovery, and vendor support.
Data protection
Encryption in transit and at rest, protected secrets and keys, data minimization, and secure retention/disposal procedures.
Auditability
Traceable financial and administrative events, meaningful timestamps, controlled changes, and tamper-evident log strategy.
Backup & recovery
Documented backups, tested restoration, agreed recovery objectives, and evidence that restores work.
Release management
Signed/versioned releases where feasible, controlled schema migrations, rollback planning, and customer acceptance testing.
Operations & support
Defined support access, incident response, patch responsibilities, monitoring, and escalation procedures.
CUSTOMER-HOSTED DEPLOYMENT
Agree the shared
responsibility model.
Each customer deployment should have a written operating agreement. Hosting location alone does not determine security or compliance.
| Topic | Questions to resolve |
|---|---|
| Infrastructure | Who provisions, hardens, monitors, and patches servers, operating systems, databases, and networks? |
| Application | Who installs updates, manages configuration, and validates compatibility? |
| Data & keys | Who controls encryption keys, backup access, retention, exports, and secure deletion? |
| Support | What remote access is permitted, for how long, and how is it approved and logged? |
| Recovery | What recovery time and recovery point objectives are agreed, and how often are restores tested? |
| Incident handling | Who triages incidents, preserves evidence, notifies affected parties, and coordinates remediation? |
DEPLOYMENT MAP
See where your data perimeter sits.
Switch between the two customer-hosted setups. Select any part of the map to see what runs there, who controls it and what crosses the boundary.
Your people
HTTPS
Data perimeter: your AWS account, in the US region you choose
Outside the perimeter
Controlled exits
Select part of the map
Everything inside the dashed boundary is under your firm's control. Participant data does not leave it except through the exits on the right.
Reference setup. The exact components, region, backups and support terms are agreed with each customer in the written deployment plan.
AI GUARDRAILS
AI never changes a ledger balance.
AI features in KinetiPlan are planned, not live in the pilot. They are being designed under the rules below, and the rules apply before any AI feature ships. Statutory limits and balances stay with deterministic, tested code and the people who approve it.
No write access to the ledger
The AI component is designed to have read-only access. It cannot post, edit or reverse transactions, balances, contributions, loans or distributions.
Limits are code, not AI
402(g), 415(c), ADP/ACP and eligibility rules run as deterministic code with fixed inputs. The same inputs always give the same result.
A named person approves
Any AI suggestion is labeled as AI and does nothing until a named user accepts it. The approval is recorded with who, when and why.
Logged and switchable
AI prompts and outputs are designed to be written to the audit log, and a firm can switch AI features off entirely.
Human checkpoints in the workflow
- Payroll intakeCode validates the file. AI may explain an exception. Staff decide the fix.
- Census and eligibilityRules calculate entry dates. AI may flag outliers. Staff confirm.
- Compliance testingCode runs the tests. AI may draft a plain-English summary. An analyst signs off.
- Ledger postingOnly authorized users post, through rule checks. AI has no posting path.
- Form 5500 and EFAST2Generated from plan data by rules. Nothing is filed until a person approves and the sponsor signs.
KinetiPlan is not a certified testing engine, and AI output is never treated as legal, tax or investment advice.
Risk mitigation and liability. How validation overrides are meant to be logged with who and why, why statutory limits such as 402(g) and 415(c) run as deterministic code rules rather than AI, and why there is no money-movement path to fail. Read the E&O risk mitigation page →
HOW THIS WEBSITE IS HOSTED
Facts you can check today.
The product's deployment model is agreed with each customer, as described above. This marketing website runs on the setup below, operated by Software Home, the team that develops KinetiPlan.
WHERE CUSTOMER DATA LIVES
Production data is hosted on AWS in the United States.
Plan, census and payroll data in KinetiPlan is hosted in US-based Amazon Web Services data centers. Software Home follows SOC 2-aligned security practices, and no production participant data is stored offshore.
- US-hosted on AWS. Real customer data lives in an AWS region in the United States.
- SOC 2-aligned practices. Software Home follows security practices aligned with SOC 2 control areas. A formal SOC 2 audit report is not yet available.
- No standing offshore access. The proposed support model gives the engineering team no routine access to production data. Any support session is approved by you, time-limited and logged.
- Customer-hosted option. Firms that prefer it can run KinetiPlan in their own cloud account under their own access policies.
- The demo and this website hold no participant data. The demo uses synthetic data only, and this website only collects what you type into the contact form.
Amazon Web Services
Pages are stored in Amazon S3 in the US East (N. Virginia) region and delivered worldwide through the Amazon CloudFront content delivery network.
HTTPS only
Every request is redirected to HTTPS, served over HTTP/2 with TLS 1.2 or newer, using a certificate issued by AWS Certificate Manager.
Security headers
Responses carry HTTP Strict Transport Security for one year, X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, a strict-origin-when-cross-origin referrer policy and X-XSS-Protection.
Versioned content
Object versioning is enabled on the site's storage, and a backup copy is taken before every content release, so any page can be restored to an earlier version.
Contact form handling
Inquiries are sent over HTTPS to a private function, checked for spam, stored in private storage and emailed to the team through Amazon SES from a DKIM-signed domain.
Report a vulnerability
A security contact is published at /.well-known/security.txt. Email hello@software-home.net with details and we will respond.
The demo application uses synthetic data only. The cards below describe this marketing website, which is served from AWS US East and holds no customer data. SOC 2-aligned means our practices follow SOC 2 control areas; it is not a completed SOC 2 audit report.
TECHNICAL DISCOVERY
Let’s define your deployment requirements.
Discuss hosting, access controls, integrations, recovery expectations, and the evidence your organization needs before a pilot.