Learn what's normal.
Contain what isn't.
Kekkai quietly learns how each app normally behaves. If something changes in a risky way, it tells you what changed — and can limit that app's network access until you decide.
No spam. Email only for beta access.
Why Baseline-First?
Traditional security focuses on known threats. Kekkai focuses on what's normal for you.
Learn Normal Behavior
Kekkai builds a baseline of what's typical for each app - network patterns, permissions usage, and behavior fingerprints.
Detect Meaningful Drift
When an app starts behaving differently in security-relevant ways, Kekkai flags it. No false alarms from normal updates.
Contain Anomalies
In Protect mode, anomalous apps get their network access contained until you review and approve the changes.
Three Modes, Your Choice
Start gentle with monitoring, enable protection when ready, or go full defensive.
Monitor Mode
Passive learning. Kekkai observes and builds baselines but takes no action. Perfect for getting started.
Protect Mode
Active containment. Apps that drift from baseline get network access restricted until you review the changes.
Redline Mode
Maximum security. All apps start contained. You explicitly whitelist trusted behavior. For high-threat scenarios.
How It Works
Simple three-step process, all happening on your device.
Sensors Collect Metadata
Network flows, permission usage, app behaviors - all metadata-only. No content inspection.
Local Analysis
On-device ML compares current behavior against established baselines. Detects meaningful drift.
Containment
VPN-based enforcement blocks network access for anomalous apps. You review, approve, or block.
See What Changed
No black boxes. Kekkai shows you exactly what triggered an alert.
Before (Baseline)
Network: 2-3 requests/hour to api.example.com
Permissions: Camera, Storage (read)
Background: Minimal activity
After (Drift Detected)
Network: 45 requests/hour to unknown-server.xyz
Permissions: Camera, Storage, Location (new!)
Background: High activity (300% increase)
Privacy Commitments
Non-negotiable principles that guide everything we build.
Metadata-only. Never message content, browsing data, or keystrokes.
Local-first. All analysis happens on your device.
No TLS interception. No man-in-the-middle attacks.
User-controlled exports. Your data, your choice.
Transparent about Android limitations. No false promises.
What's Next
We're building in the open. Here's what's coming.
VPN Feasibility Spike (M0.11)
Feb 2026Stable VPN lifecycle, notifications, conflict handling, kill switch implementation.
Storage + Privacy Foundation (M1)
Mar 2026Local incident storage, privacy controls, data retention policies.
Monitor Mode Sensors (M2)
Apr-May 2026Network monitoring, permission tracking, behavior baselines v0.
Join the Waitlist
Be the first to know when Kekkai enters beta. No spam, just important updates.