What Kita stores

The path of a file

1. Upload. The file goes from the borrower's device straight to Kita over TLS. Its type is checked from the bytes, not the name. Duplicates within a session are detected by SHA-256. A password-protected PDF is unlocked in memory with the password the borrower types; the password is never stored.
2. Extraction. Each file is read by a vision-language model behind a chain of fallback providers. If one provider fails, the next is tried within the same request. If all fail, the file is marked failed; Kita never invents values.
3. Signals. The extraction is flattened into about 300 signals: bank totals and balances, payslip income and deductions, payroll markers, address details, document and capture quality, file metadata and consistency checks. Bank statements, payslips and utility bills get their own structured fields; other documents, such as invoices, are classified and get the document-level signals.
4. Delivery. Scores or a backtest archive, as agreed.

Backtest archive

For a backtest, Kita keeps one folder per applicant in a private, encrypted bucket in the region agreed with you. For Mexican lenders that is AWS Mexico (mx-central-1).

sessions/{session_id}/applicant.json      one per applicant, written last
sessions/{session_id}/files/{document_id}.pdf | .png | .jpg | .heic

applicant.json holds your reference_id, the consent record, timestamps and a documents list. Each entry is one uploaded file with its own raw extraction, its flat signal row, its detected type, its SHA-256 and the provider that read it. When a borrower uploads several files, each keeps its own entry. Nothing is merged, so how to combine files stays a decision made with the data in hand.

There are no scores in a backtest archive and none are returned to you; the backtest report is built from the raw signals and your outcomes.

Retention and deletion

• A session and its files expire 24 hours after creation unless agreed otherwise. Files a borrower uploaded but never shared are never archived.
• DELETE /v1/risk/sessions/{id} removes the session and its archive folder.
• The consent text the borrower accepted is versioned and recorded with a timestamp on the session.