Trust & security
KimiShip is self-hosted in Germany and keeps authentication, tenant isolation, and recovery controls under its own operational control.
Users authenticate with Google OpenID Connect through KimiShip’s self-hosted Keycloak broker. KimiShip requests only openid profile email, requires a verified email and a signed Google-broker origin claim, and stores no Google access or refresh token.
Keycloak proves identity; KimiShip decides admission. Closed, invite, and public modes are explicit. Suspended or deleting accounts are rejected on every protected Web and MCP request, including requests carrying an otherwise unexpired session.
Core records carry an owner ID. Application queries are owner-scoped and Postgres row-level security provides a second enforcement layer. MCP sessions and media paths are bound to the authenticated owner.
The app, MCP server, Keycloak, Postgres, and media store run on Hetzner infrastructure in Germany. Public traffic uses HTTPS. The remote MCP flow uses OAuth 2.1, PKCE S256, RFC 8707 resource indicators, and RFC 9728 metadata.
App data, Keycloak identities, and media are validated, archived, and encrypted locally with age before upload to the backup storage provider. Failure paths remove plaintext work files and never upload an unencrypted dump.
Codex remains the primary writing and reasoning environment. Optional image or quality providers are activated only by the user with their own key. Stored provider secrets are encrypted and are excluded from account exports.
Authenticated users can download a structured data export and request deletion. A deletion request blocks access immediately; final removal from Keycloak, Postgres, and media storage follows a resumable operator procedure.
Anonymous OAuth endpoints, authenticated MCP calls, uploads, and total owner media storage have server-side limits. KimiShip currently does not use reCAPTCHA; an unused reCAPTCHA key is not part of the security boundary.
Please report suspected vulnerabilities privately to security@kimiship.cc.