Skip to main content
Written for a client security team looking at Keldyn before they connect the Keldyn MCP server (KC). It covers the frameworks the engineering practice tracks itself against, and how often the service behind KC is tested. Encryption, access control, and retention are on Data security. Training, subprocessors, and GDPR are on Compliance. The engineering security program uses the same control catalog that ships in the product: application security, and the AI-specific set.

​
Security frameworks we align with

Application security
  • OWASP Top 10
  • OWASP ASVS (Application Security Verification Standard)
  • OWASP WSTG (Web Security Testing Guide)
  • App Defense Alliance CASA (Cloud Application Security Assessment)
  • MITRE ATT&CK
  • OAuth 2.0 Security Best Current Practice (RFC 9700)
  • PCI DSS (for payment-adjacent controls)
AI-specific security. These apply to Keldyn’s own AI features, not only to the frameworks customers track:
  • MITRE ATLAS (Adversarial Threat Landscape for AI Systems)
  • NIST AI RMF (AI Risk Management Framework)
  • NIST AI 600-1 (Generative AI Profile)
  • OWASP LLM Top 10
  • OWASP ML Top 10
  • OWASP Agentic Top 10 (Agentic Security Initiative)
  • CSA AI Controls Matrix (Cloud Security Alliance)
Some individual controls also cite ENISA guidance and published AI-security research, alongside the frameworks above.

​
How we test for vulnerabilities, and how often

  • Every pull request. Lint, unit tests, integration tests, and end-to-end tests (API and web) run before merge. A dependency scan blocks the merge if a package has a known vulnerability. A person still reviews the pull request for authorization, secrets handling, and AI-control impact before it ships.
  • Architecture threat modeling. Threagile runs against Keldyn’s own service architecture, the same analysis the product runs for a customer use case, and again whenever that architecture changes.
  • Manual red-team and adversarial testing. Prompt injection, jailbreak attempts, and agentic-coordination abuse are tested while a feature is being built, then again on a cycle of roughly six to eight weeks.