SecurityWhole classes of attack can't happen, because of how apps are built.Your app runs on the server, and the browser only receives instructions for what to show. The browser can't query your data, so nobody can expose it by mistake.
How the runtime is built
Your logic never ships to the browserYour app runs on the server. The browser receives instructions for what to show and sends back what the user does. Your business rules, queries and prompts stay on the server, so there is no browser code to decompile and no check in the browser to get around.
Credentials stay on the serverDatabase connection strings, third-party tokens and the keys for 200+ AI models are held by the platform and used only on the server. Your app asks for a model but never holds an API key. Secrets you add yourself are stored in the same place, and only your app's code can read them.
Nothing is public until you say soBy default, an app has no HTTP endpoints. The only endpoints are the ones you declare. No data API is generated for you and left open behind a check in the browser.
Each app is kept separateEach app has its own storage, its own database and its own deployed bundle. The platform is built this way, so there is no setting you can get wrong.
Compliance built into the platformNamed regulations, and what the runtime does about each one.
GDPR — Regulation (EU) 2016/679Data is processed in the EU by default, and AI model calls can be limited to one region. Deleting a person's data is built into the platform, so you don't have to build it. One deletion covers every store the platform owns, including your app's own data, so a request to delete an account can be carried out in full.
EU AI Act — Article 50In force since August 2026. People always know when they are dealing with AI: agents join calls, chats and boards as named, visible participants, and generated media carries machine-readable provenance marks. The platform does this for every app that runs on it.
US disclosure & provenanceProvenance marks on generated media (California) and telling people when they are talking to AI (Illinois, Utah) are your duties as the builder. The platform handles both by default.
Reporting a vulnerabilityIf you believe you have found a vulnerability, write to us and we will reply. Please give us a reasonable window to fix it before publishing anything.contact@ikonai.comIf your project has a procurement review ahead of it, talk to us early. We'll answer your security team's questionnaire, so you don't have to guess at the answers.
Your turn.