Ir para o conteúdo

Security Overview

Última atualização: 2026-06-12

This page summarises Kuaray Oka's security posture for customers, prospective customers, and security researchers. It is informational and is not a certification. Contractual security terms live in the Terms of Service and DPA.

1. Hosting and isolation

Kuaray Oka runs on Amazon Web Services in the us-east-1 region. The application is deployed as Fargate tasks on ECS behind an Application Load Balancer; the database is Amazon RDS for PostgreSQL. Production and development are isolated AWS accounts with separate VPCs, IAM roles, KMS keys, ECR repositories, and Stripe accounts.

2. Encryption

  • In transit: TLS 1.2+ everywhere — public endpoints (HSTS), ALB → ECS, ECS → RDS, ECS → outbound APIs. HTTP requests are redirected to HTTPS.
  • At rest: RDS storage is encrypted with AWS KMS. S3 buckets that store user-uploaded media are encrypted at rest and served via CloudFront with origin access controls. Application secrets live in AWS Secrets Manager and are injected into containers at runtime, never baked into images.
  • Passwords: Account-holder passwords are hashed with BCrypt (cost 12). We do not store passwords in plaintext or recover them — only reset.

3. Authentication

Authentication is handled by Auth.js v5 (NextAuth) with two options: Sign in with Google (OAuth) and email + password (Credentials). Sessions use RS256-signed JWTs validated by the backend through the JWKS endpoint at /api/auth/jwks. Self-serve password reset is available at /forgot-password; in-app password change is available under /dashboard/account.

4. Multi-tenancy

Each account holder is mapped 1:1 to a workspace; all data is keyed by workspace_id and isolated at the application and database layers. There is no cross-tenant data access, and workspace-scoped requests are derived from the authenticated JWT on every call.

5. Backups and durability

RDS automated daily backups are retained for at least 7 days in production with point-in-time recovery enabled. Object storage in S3 has versioning enabled on customer-content buckets. Restore procedures are documented and tested quarterly.

6. Logging and monitoring

Application and access logs are streamed to CloudWatch and retained per our retention policy. Authentication events, billing actions, and admin actions emit structured events; secrets and bearer tokens are scrubbed before storage. Alerts cover error-rate anomalies, failed deploys, and Stripe webhook anomalies.

7. Software development lifecycle

  • All changes go through pull-request review and CI (build, unit tests, lint, type-check, Terraform validate) before merge.
  • Database schema changes are append-only Flyway migrations, never edited in place.
  • Production deploys are gated on a published GitHub Release and cut from the same artifact built and tested on main.
  • Dependencies are tracked and security advisories are reviewed regularly.

8. Sub-processors

The third-party providers we use to deliver the Service are listed on /legal/subprocessors. Each sub-processor is selected with privacy and security in mind and is contractually bound by our DPA terms or equivalent.

9. Reporting a vulnerability

If you believe you have discovered a security issue, please email info+privacy@kuaray.tech with reproduction steps. We will acknowledge receipt within 3 business days and keep you informed of the resolution. We appreciate coordinated disclosure and will not pursue good-faith researchers who follow it.

10. Status

This page is updated as our posture changes. We are not yet independently certified (ISO 27001 / SOC 2). Customers under enterprise procurement can request a security questionnaire at info+privacy@kuaray.tech.

← Legal