KAS incident notification
AI Verify process checks 1.5.1, 9.5.4. This page is the public text for those checks. It is not a pass mark. Certification is in progress. Qypu holds no certificate yet.
In one line
How Qypu would tell end users about a KAS incident, and the draft process for a decision that should not have stood.
The short version
This short version helps you understand the full text. Read the full text for the complete terms.
- This draft says how Qypu tells a person about a KAS incident. It is not in force. (Full text, Who we tell)
- If that changes, we tell the affected person what happened, what data was involved, and what they can do. (Telling end users)
- A personal-data breach also follows the trust centre incident page. Those deadlines are not confirmed for KAS. (Telling end users)
- A wrong allow, a wrong refusal, a broken tape, or a leaked key is an incident under the draft below. (AI decisions)
- No team is appointed, and no closure rate is measured, because the process is not operating. (What is not operating)
Full text
Which checks this page answers
This page is the public text for AI Verify process checks 1.5.1 and 9.5.4. It is a draft. It does not describe a process that is running.
Who we tell
This page is a draft. It is not in force. It says how Qypu tells a person about a KAS incident. KAS stops an agent from taking an action you have not allowed. Qypu stands behind that.
Telling end users
Check 1.5.1 asks for a way to tell end users that an incident happened. This is that policy, for a future deployment. It is not in force.
When Qypu confirms that a KAS incident affected a person, Qypu will write to that person. The note will say what happened, what data was involved, what Qypu is doing, and what the person can do.
The note goes to the workspace owner where there is one, and to the affected person where the law requires a direct note. Qypu will not wait for a press post to be the first notice.
Personal-data breaches for the Qypu product are described on the incident and breach page. That page is also a draft. Its deadlines, including 48 hours to a workspace owner, are not confirmed for KAS. This page sets no extra number.
Regulator notice, where Qypu is the controller, stays on that same incident page. Annex F of the privacy notice states the Singapore breach notice to the Personal Data Protection Commission.
AI decisions
Check 9.5.4 asks for an incident process when an action or a decision affects the outcome of the system. For KAS, the outcome is an allow, a refusal, or a hold.
The draft treats these as incidents:
- The gate allowed an effect the mandate did not allow.
- The gate refused an effect and that refusal blocked a person who was entitled to the effect.
- A receipt does not match the action, or the tape cannot be checked.
- An issuer key or an operator key is copied, lost, or used after it was retired.
Anyone can report one of these through the concern channel. A person who runs a gate reports it to security@qypu.ai as well.
The draft steps are these. Record the report and the time. Pause the gate or revoke the mandate, where the operator can. Find who was affected. Tell them under the section above. Fix the cause. Write down what changed. Do not put an exploit in a public issue. That last rule follows SECURITY.md, and it is there to protect other people's systems.
What is not operating
No person is named on this page as the incident lead, other than the mail route. Mail to security@qypu.ai routes to Byron Fuller. No second accountable person is appointed here.
No incident team is appointed. GOVERNANCE.md says reviewers are not separated from the author. This page does not pretend that a skilled, separate team is in place.
No rate of implemented recommendations is measured. There is no operating process, so there is no set of recommendations to count.
There is no review date for this page. A calendar for reviewing it is not set.
Intellectual property in a report stays in the mailbox. A vulnerability report is not a public post.
Change log
- 2026-10-25 · 0.1.1 · Who we tell, without a customer count. The draft is not in force.
- 2026-10-23 · 0.1.0 · First public draft. Not in force. No KAS incident process is operating.
Contact
Qypu, Inc., a Delaware C corporation. Contact address: 51A Marang Road, Singapore 099281. Privacy mail privacy@qypu.ai and security mail security@qypu.ai route to Byron Fuller.
KAS · KAS governance · Trust centre · Privacy · Privacy notice