Loading the SOTA2 catalog…
Kita
The AI-native stack for modern underwriting — bespoke to every lending use case. Underwrite borrowers anywhere in the world in minutes.
- Founded
- 2026
- Headquarters
- San Francisco, California, USA
- Company size
- 1–10
- Products tracked
- 6
Products by Kita
Pricing for Kita
Usage Based
This is the broad commercial model reported for Kita. Product-level terms are listed below when available.
- Pricing model
- Usage Based
- Entry option
- Free plan
- Pricing model
- Usage Based
- Entry option
- Free plan
- Pricing model
- Usage Based
- Entry option
- Free plan
- Pricing model
- Usage Based
- Entry option
- Free plan
- Pricing model
- Usage Based
- Entry option
- Free plan
- Pricing model
- Usage Based
- Entry option
- Free plan
Trust profile
Security and compliance
ISO/IEC 27001
SOC 2 Type II
Trust Services Criteria
AES-256 encryption at rest
TLS 1.3 encryption in transit
Automatic key rotation in managed KMS with split-knowledge access
SSO via SAML 2.0 (Okta, Azure AD, Google Workspace) on Enterprise
MFA enforced for all human access
Role-based permissions
Scoped API keys per environment
Session timeouts
Private VPC networking, no public ingress to compute
Edge WAF and DDoS protection
Egress allowlists for outbound traffic
Strict logical tenant isolation; no data, compute, or model context shared across tenants
Dedicated environments available on Enterprise
Audit logging with timestamps, user, and request ID; tamper-evident; retained 12+ months
Logs streamable to customer SIEM
Threat-modeling on every new surface
Mandatory peer review and security review for auth, encryption, or data egress changes
Branch protection on every repository
Automated SAST on every pull request
Dependency vulnerability scanning blocking known CVEs
Container image scanning at build and runtime
No long-lived credentials in code; all secrets vaulted via short-lived tokens
Secrets rotated on fixed schedule and on personnel changes
Locked dependency manifests, signed builds, reproducible CI
SBOM available on request
Third-party libraries reviewed before introduction
Pre-signed URLs scoped to single upload, never reusable
Single-tenant isolated compute for document processing; no cross-tenant context or shared memory
Encrypted backups with point-in-time recovery
Restoration tested on documented schedule
Multi-AZ architecture by default
Regional failover playbooks exercised regularly
Documented incident response plan with severity levels, on-call rotation, and escalation paths
Customer notification typically within 72 hours of confirmed impact
Annual third-party penetration tests
Continuous internal scanning
Responsible disclosure program
Background-checked engineers with production access
Annual security and privacy training for all team members
Secure-coding training for engineers
NDAs and confidentiality clauses before access to customer data
Least-privilege, time-bound, MFA-gated production access
Access revoked same day on offboarding; quarterly access reviews
Customer-managed encryption keys (BYOK) scoped per deployment
VPC and on-premises deployments available on Enterprise
SCIM-based provisioning available on request