Kimi commits to industry-standard technical and organizational security measures
Section 6.1 states: “We fully understand that the security and confidentiality of personal information is of the utmost importance to you. We will do our best to avoid collecting irrelevant user information, and adopt technical and organizational measures no lower than general industry standards to protect your personal information from unauthorized access, public disclosure, use, modification, damage, or loss, including but not limited to:” The commitment is expressed as doing Kimi’s best and as measures no lower than general industry standards; the following items in 6.1 spell out encryption, transmission security, system protection, institutional safeguards, backups and breach monitoring.
Supporting quotations
6.1 We fully understand that the security and confidentiality of personal information is of the utmost importance to you. We will do our best to avoid collecting irrelevant user information, and adopt technical and organizational measures no lower than general industry standards to protect your personal information from unauthorized access, public disclosure, use, modification, damage, or loss, including but not limited to:
Qualifications & exceptions
The standard is stated as “no lower than general industry standards” and as doing “our best,” so it is a best-effort commitment rather than a guarantee of a specific security level.
Security & Safeguards · Company commitment
Personal information is encrypted both at rest and in transmission
Section 6.1 lists two encryption measures. Data encryption: “We will use industry-leading encryption algorithms to encrypt users' personal information, ensuring that even if the data is obtained by an unauthorized third party, the user's actual information cannot be parsed.” Data transmission security: “We use encryption technology to provide reliable encryption protection for communications between users and servers, ensuring that data is not intercepted or tampered with during transmission.”
Supporting quotations
Data encryption: We will use industry-leading encryption algorithms to encrypt users' personal information, ensuring that even if the data is obtained by an unauthorized third party, the user's actual information cannot be parsed.
Data transmission security: We use encryption technology to provide reliable encryption protection for communications between users and servers, ensuring that data is not intercepted or tampered with during transmission.
Security & Safeguards · Company practice
Kimi runs regular security inspections, data backups and breach monitoring
Section 6.1 describes operational safeguards. System security protection: “We regularly conduct security inspections and vulnerability patching for servers and systems to prevent hacker attacks and virus intrusions.” Data backup: “We regularly back up users' personal information data and store the backup data in different physical locations, so as to reduce the risk of data loss due to accidents or disasters.” Data breach warning: “We have established a real-time monitoring system to monitor abnormal data access and breaches. Once signs of a data breach are detected, we will immediately take measures to stop the breach, decisively identify the cause, and formulate corresponding improvement measures.”
Supporting quotations
System security protection: We regularly conduct security inspections and vulnerability patching for servers and systems to prevent hacker attacks and virus intrusions.
Data backup: We regularly back up users' personal information data and store the backup data in different physical locations, so as to reduce the risk of data loss due to accidents or disasters.
Data breach warning: We have established a real-time monitoring system to monitor abnormal data access and breaches. Once signs of a data breach are detected, we will immediately take measures to stop the breach, decisively identify the cause, and formulate corresponding improvement measures.
Security & Safeguards · Company practice
A dedicated data protection department limits and supervises employee access
Section 6.1 states: “We have established a dedicated data protection department and designated a person in charge, responsible for the protection of users' personal information. We regularly conduct training and education on personal information protection for company employees, ensuring that all employees understand and attach importance to the protection of users' personal information. We strictly limit company employees' access rights to user data, allowing specific employees to access relevant data only when business needs require. We supervise and evaluate employees who access users' personal information, and promptly handle any improper conduct upon discovery.”
Supporting quotations
Institutional safeguards: We have established a dedicated data protection department and designated a person in charge, responsible for the protection of users' personal information. We regularly conduct training and education on personal information protection for company employees, ensuring that all employees understand and attach importance to the protection of users' personal information. We strictly limit company employees' access rights to user data, allowing specific employees to access relevant data only when business needs require. We supervise and evaluate employees who access users' personal information, and promptly handle any improper conduct upon discovery.
Security & Safeguards · Company commitment
Sensitive personal information is processed only after separate consent
Section 6.2 states: “For sensitive personal information, we will obtain your separate consent before processing and adopt stricter security measures.” This is a consent condition for a defined category of data and a promise of stronger safeguards.
Supporting quotations
6.2 For sensitive personal information, we will obtain your separate consent before processing and adopt stricter security measures.
Security & Safeguards · Restriction or exception
Kimi warns the internet is not fully secure and cannot guarantee absolute safety
Section 6.3 states: “Please pay special attention that, due to the limitations of technical and management measures, the Internet environment is not 100% secure. Once certain information is leaked, the consequences are irreversible. Although we have taken the above measures and strive to improve the level of security, we cannot guarantee absolute security. We strongly recommend that you take more proactive security measures together with us and avoid high-risk actions such as lending out your account, disclosing verification codes, and uploading sensitive information.” The section qualifies the security commitments of 6.1-6.2 and places part of the risk on the user.
Supporting quotations
6.3 Please pay special attention that, due to the limitations of technical and management measures, the Internet environment is not 100% secure. Once certain information is leaked, the consequences are irreversible. Although we have taken the above measures and strive to improve the level of security, we cannot guarantee absolute security. We strongly recommend that you take more proactive security measures together with us and avoid high-risk actions such as lending out your account, disclosing verification codes, and uploading sensitive information.
Qualifications & exceptions
This limits the scope of the 6.1-6.2 safeguards: Kimi expressly disclaims an absolute-security guarantee.
Security & Safeguards · Company commitment
A security incident triggers an emergency plan, user notice and regulator report
Section 6.4 states: “We have formulated a cybersecurity incident emergency response plan. If a security incident such as a personal information breach unfortunately occurs, we will immediately activate the emergency response plan and take measures to prevent the harm from expanding. We will promptly inform you of the basic situation of the security incident, its possible impact, and the remedial measures we have taken, by means such as telephone and push notifications. Where it is difficult to inform each personal information subject individually, we will adopt reasonable and effective means to issue an announcement. At the same time, we will also report the relevant situation to the regulatory authorities, cooperate with the investigation, and pursue the legal liability of the responsible parties.”
Supporting quotations
6.4 We have formulated a cybersecurity incident emergency response plan. If a security incident such as a personal information breach unfortunately occurs, we will immediately activate the emergency response plan and take measures to prevent the harm from expanding. We will promptly inform you of the basic situation of the security incident, its possible impact, and the remedial measures we have taken, by means such as telephone and push notifications. Where it is difficult to inform each personal information subject individually, we will adopt reasonable and effective means to issue an announcement. At the same time, we will also report the relevant situation to the regulatory authorities, cooperate with the investigation, and pursue the legal liability of the responsible parties.
Qualifications & exceptions
Individual notice may be replaced by a public announcement where individual notice is difficult.