Security & Compliance

ISO 27001 Certified

Kii Corporation maintains ISO 27001 certification, the internationally recognized standard for information security management systems (ISMS). For tank monitoring customers, this certification carries specific implications:

• Formal risk management — ISO 27001 requires ongoing identification and treatment of information security risks across the organization, ensuring that security controls reflect the actual threat landscape rather than a generic checklist.
• Continuous improvement — The certification requires ongoing internal audits, risk reassessment, and corrective action. Security practices evolve alongside emerging threats and changing regulatory requirements.

The certification rests on a Basic Information Security Policy, first established in February 2015 and most recently revised in December 2025, issued by the company’s President and applying across the organization. It commits Kii to comply with customer contracts and with legal and regulatory requirements, to prevent information security incidents, and to protect information assets from security threats — supported by a designated information security manager and committee, documented risk assessment procedures and criteria, and continuous training whose effectiveness is measured.

Protecting Commercially Sensitive Data

Tank level data, fuel consumption trends, and delivery schedules are commercially sensitive. In aggregate, this information can reveal purchasing patterns, demand forecasts, and per-site revenue indicators. The Kii platform applies formal data classification, role-based access controls, and data leakage prevention measures to ensure that customer operational data is accessible only to authorized users.

• Encryption — Data is encrypted in transit and at rest
• Access control — Role-based permissions ensure users see only what their role requires
• Audit trails — Platform activity is logged for accountability and traceability
• Multi-tenant isolation — Each customer’s data is logically segregated within the platform

Device and Connectivity Security

ATGs and field sensors are operational technology (OT) devices that require careful handling. The Kii platform applies network segmentation between the data ingestion layer (which communicates with field devices) and the customer-facing application layer. Gateway configurations, device credentials, and firmware updates are managed under formal change control processes.

Layered Protection for Site Equipment

Operational technology now faces a more hostile security environment. Capabilities driven by artificial intelligence make it faster and cheaper to discover exposed devices, identify their vulnerabilities, and automate attacks against them, and equipment that was once obscure is now routinely scanned and targeted. Federal agencies have responded with guidance for the fuel industry, including a June 2026 joint advisory on automatic tank gauges from CISA, the FBI, the NSA, and five other agencies.

Kii’s architecture is designed for this environment. Protection does not depend on any single control; it is built from independent layers:

• No exposure to the public internet — Kii never exposes an automatic tank gauge to the public internet, the first measure the federal guidance calls for
• Allowlisted commands — the platform sends tank gauges only read-only requests from a fixed allowlist, and commands that would change a device’s configuration are never sent
• Cryptographic signatures — commands relayed to site equipment over the network are digitally signed, so their origin and integrity are verified before they are carried out
• Safeguards against configuration errors — settings entered by technicians and console operators are checked for values that equipment could misinterpret

The layers extend one another only the minimum trust required: each verifies what it receives instead of relying on the layer before it, so a single weakness does not expose the operation.

Vendor Assessments

Enterprise customers evaluating Kii for large-scale deployments are welcome to request additional security documentation, including details on data handling practices, incident response procedures, and infrastructure architecture. ISO 27001 certification provides a recognized framework for these assessments, aligning with common procurement questionnaires such as the Shared Assessments SIG.

Related Policies

• Website Privacy Policy — how this website handles personal information
• Kii Cloud Privacy Policy — personal data stored in Kii Cloud
• Terms and Conditions — terms governing use of the Kii site, software, and services

Contact the team at productsupport@kii.com or through the Contact page.