Security & Privacy

Fraud prevention

No number to ring. No inbox to fill.

The Ken has no phone number, no email address, no web browser and no app store. There is nothing on it to dial, nothing to mail, and nothing to browse into, so a cold caller has nowhere to call and a phishing message has nowhere to land.

Reaching the screen at all takes a credential your family was given: an account with a role on that Ken, or the family link the portal hands out. The contacts you approve in the portal are the ones whose faces appear on the screen and whose names the Ken knows.

No phone number - no number for a cold caller to dial, and no SIM card
No email - there is no email client on the Ken, so a phishing message has nowhere to arrive
No web browser - no malicious links, no pop-ups, no fraudulent websites
No app store - no accidental downloads, subscriptions, or in-app purchases
No ads, no pop-ups - the Ken shows what matters and nothing designed to sell to the person using it
Family-controlled - the approved contact list is managed from the admin portal by the family members and carers you authorise
Removing someone - removing a contact takes their tile off the Ken's screen. If that person also holds an account on your Ken, revoke their access on the People page as well, which is what withdraws their ability to call

How we protect your data on the Ken itself

If the Ken goes missing, you can shut it out.

Report a Ken lost or stolen from the portal and our servers stop answering it. No start-up key, no check-in, no updates, and if it is switched on at the time it locks its screen there and then. Without our servers a Ken cannot call, cannot be called, and cannot fetch a thing.

Report it lost or stolen - from the admin portal. A lost report goes straight through and can be placed by an admin or a carer. A stolen report can only be placed by an admin, and asks for the crime reference number and the police force first, because you cannot undo it yourself. From that moment our servers turn away that Ken's start-up, check-in and update requests
Lost, then found - a lost report lifts the moment you tap "I found it", and lifts on its own after 14 days. The Ken then starts up and works exactly as it did before, with everything on it still there. A stolen report is permanent, only our support team can lift it, and it destroys the Ken's start-up key for good
What sits on the Ken itself - messages, contacts, voicemails and photos are stored on the Ken's own storage card, and that storage is not encrypted. Anyone who takes the card out and puts it in a computer can read them. The protection for a missing Ken is the lock above, which stops the Ken working, and not the card, and we would rather say so than let you assume otherwise
Hardware on the record - every cloud request carries the Ken's processor serial alongside its own credential. A serial that changes is recorded, so the card moving to different hardware shows up in the audit trail and support can see it. We re-record rather than refuse, because a repaired Ken with a new board is the same Ken and has to keep working; the credential, and the lost-and-stolen lock above, are what stop a copied card being used

How we protect your data between the Ken and the cloud

Nobody sits between your Ken and us.

When the Ken calls our servers it checks them against keys held in its own software. Someone on your Wi-Fi cannot pretend to be us, even holding a genuine-looking certificate from somewhere else.

Certificate pinning - the Ken walks the certificate chain itself on every call to our API and drops the connection unless it was issued under one of two public keys held in its software: the issuing intermediate and the root above it. We leave the individual site certificate out of that check on purpose, because it changes every 90 days and pinning it would book an outage. New pins arrive inside signed updates
Signed software updates - every update bundle is signed with an Ed25519 key we hold. The Ken checks the bundle's fingerprint, then checks the verification key's own fingerprint against a value hardcoded in the updater, then checks the signature. Any one of the three failing stops the install before a single file is written, and a swapped verification key is reported to us before the signature is even looked at
Pinned supply chain - when we build a Ken, the Node.js runtime and the speech recognition model are downloaded against a SHA-256 we hold in the repository, and the build stops on any mismatch. The application's own dependencies install from a locked list carrying a hash for each one. Operating system packages come from Debian's cryptographically signed repositories
HTTPS with forward secrecy - requests between the Ken, our cloud and your app are encrypted in transit with modern cipher suites, so a key compromised later cannot decrypt earlier traffic. A video call takes a different road: it runs straight between the two ends wherever the network allows, encrypted with keys made fresh for that one call. A live call is never recorded

How we protect your account

Getting in takes an invitation you sent.

Email-verified enrolment - when you buy a Ken, we email a 6-character setup code to the address used at checkout. It works once. Only someone holding both the Ken and that mailbox can enrol it. Two older shapes are still accepted, for codes already in circulation: an 8-digit code from the previous format, and a 4-character code used only for moving a profile onto a replacement Ken, which is armed for a single use against one profile and then expires
Per-Ken keys - no two Kens share an API key, and one Ken's key cannot be used against another
Password hashing - PBKDF2 with 100,000 iterations of SHA-256, the ceiling the Cloudflare Workers runtime allows. We never store, log, or email passwords in plaintext
Two-step sign-in, also called MFA or multi-factor authentication - an authenticator app (TOTP, RFC 6238) is required for our own HQ staff accounts, and required for Admin accounts. An Admin account can add contacts and start a call, so it is protected as an account that can reach the Ken. Ten single-use backup codes are issued at enrolment and are accepted at sign-in and at password reset. Resetting the password on an account with two-step sign-in enabled needs the code as well as the emailed link, and the reset does not sign you in. You can tick "Remember me on this device for 30 days" when you enter a code, which skips the code on that one browser or phone for 30 days - the password is still typed and checked every single time, the 30 days runs from the day you ticked it and is not extended by using it, and every remembered device is forgotten the moment you reset your password or turn two-step sign-in off. You can see and forget them yourself in the Admin Portal
Brute-force protection - five sign-in attempts a minute from one address, and five wrong authenticator codes lock the account for 15 minutes. Registration and password reset allow five attempts every five minutes
Role-based access control - five roles (user, contact, admin, healthcare professional, HQ) with a per-action permission table. The server checks who is calling and which Ken they belong to; hiding a button in the interface is never the only control
Second-hand Ken protection - a new owner must enter a valid setup code that we email to them. Entering it retires the old device record and gives the physical Ken a fresh identity and a fresh credential. The previous owner's messages, calls, voicemails and contacts stay in their own account and never appear on the new one. The card itself is not encrypted, so whoever sells a Ken must factory-reset it first: that is what removes the copy held on the device

How we protect your data in the cloud

Medical details are encrypted before they are stored.

The most sensitive fields are turned into ciphertext on our servers before they reach the database, so a copy of the database on its own does not read them back.

AES-256-GCM field encryption - GP details, medications, allergies, conditions, NHS number, next of kin, key-safe code and the patient's date of birth are encrypted field by field before storage. A care note saved through the older medical screen carries that encryption too
What is held as ordinary text - the care-notes diary the app and the portal write to today and the older history behind it, the detail of a medication reminder (its label, the medicine's name, the dose, the instructions and any photo), and the rest of the patient record: patient number, full name, where they live, preferred hospital, communication notes and mobility level
Tokenised on deletion - when an account is deleted, the person's name, email and phone number are replaced with a random token across the records we are required to keep, and the mapping back sits in a separate store under a separate key. While an account is live, those identifiers are held in the main database in readable form
Where it sits - the database, the key-value stores and the media storage all run on Cloudflare, whose network is global, so some processing happens outside the UK and the European Economic Area under the UK International Data Transfer Addendum. Call relay, used when a direct connection cannot be made, runs on servers in Germany
Audit logging - every change to medical, care and account data is written to an audit trail, as is every export of data out of the portal. Rows are kept for 12 months
Hourly backups - the database is copied every hour to storage inside the same Cloudflare account, with 7-day retention, and once a day to Backblaze cold storage under a 35-day object lock. Medical and patient records carry their own AES-256-GCM ciphertext into both copies
Session security - HttpOnly, Secure, SameSite=Lax cookies. After 20 minutes without a click, a keystroke or a scroll, the portal signs you out in your browser. That is a courtesy in the page rather than a limit on the sign-in itself: the sign-in lasts 30 days and our servers do not end it early for sitting idle. CSRF tokens are checked on state-changing requests from a browser session
If you cancel - your data remains accessible for 30 days, and our support team can recover it for a further 60 days. Re-subscribing at any point in that 90 days restores your account, though the Ken stops making and taking calls as soon as the subscription ends. The sweep that erases the data at the end of the 90 days runs every hour and does delete. If you want your data gone sooner than that, email us and we will delete it

Vulnerability disclosure

Found a security issue? Tell us.

We welcome reports from security researchers and members of the public. If you believe you have found a vulnerability in The Ken, the portal, the family app, or our cloud services, please contact us before disclosing it publicly.

How to report

Email security@theken.uk with a clear description of the issue, the steps to reproduce it, and the potential impact. A machine-readable copy of this policy is published at /.well-known/security.txt.

What we promise

We will acknowledge your report within one working day
We will give you a substantive response within five working days
We will keep you informed as we work on a fix
We will credit you publicly on this page if you wish, once the issue is resolved
We will not take legal action against researchers who report in good faith and follow this policy

What we ask

Give us a reasonable time to fix the issue before disclosing it publicly. Ninety days is our default, less if the issue is already public, more if the fix is genuinely complex
Do not access, modify, or delete data that does not belong to you
Do not run automated scanners against the production environment without prior agreement
Do not test denial of service, social engineering, or physical attacks
Do not publish or share the issue until we have agreed it is safe to do so

Out of scope

Issues in third-party services we use (Cloudflare, Resend, Stripe) - please report to the vendor directly
Reports generated solely by automated scanners with no demonstrated impact
Missing security headers without a demonstrated exploit
Self-XSS, clickjacking on pages without sensitive actions, or rate limiting on non-authentication endpoints

Acknowledgments

Nobody has reported a vulnerability to us yet. When somebody does, and the fix is out, their name goes here if they want it.

Security update commitment

We keep your Ken patched for at least five years.

Every Ken receives security updates over the air. Each update is signed with a key we hold, checked by the Ken before it is installed, and applied on its own. There is nothing for you to do.

Our commitment. We will provide security updates for every Ken sold from the date of purchase, for a minimum of five years. We expect to provide them for longer; five years is the floor. We will not shorten it.

What an update replaces. The over-the-air channel replaces the software the Ken runs: the application, its screens, and the rules it follows. Our cloud services, the admin portal and the family app we update ourselves, on our own servers and through the app stores. The operating system underneath the application is set when we build a Ken's storage card, and we change it by issuing a new card rather than over the air.

How we tell you. Security fixes are installed automatically and quietly. New features, changes to how we handle your data, and changes to how often updates arrive are emailed to the registered account holder and posted on this page.

UK law requires a consumer connectable product to publish the minimum period for which it will receive security updates. The five years above is ours, published here so you can hold us to it.

Your privacy matters.

We collect only what is needed to run The Ken and keep people connected. We never sell your data and we never hand it to advertisers. Two machine services do see content: a voicemail is transcribed by a speech model running on Cloudflare's own infrastructure, and a question typed into our support chat is answered with help from Anthropic's Claude. Both are named in the privacy policy.

Our full Privacy Policy is available at Privacy Policy.

Terms & conditions

Terms of use.

Using The Ken and portal means you agree to our terms of service. They cover your subscription, our responsibilities, how we handle data, and your rights under UK consumer law.

Our full Terms & Conditions are available at Terms & Conditions.

Your data is safe with us.