Security

Scope

This page lists the security controls KalasOS has in place today. Each item is checked against the application code before it is listed here. It is not a certification or audit report.

Hosting

The application runs on Vercel. Authentication and tenant data are stored in a self-hosted Supabase stack (Postgres and Auth) operated by Trinity Technology Pvt. Ltd. DNS, the tenant subdomain proxy, and file storage for venue uploads (Cloudflare R2) run on Cloudflare. Email is sent through Resend. Plan payments are processed by Stripe.

Tenant isolation

Every table in the database schema has Postgres row-level security enabled. The browser receives only the public Supabase key; the service-role key is used only on the server, after the request's tenant and permissions are checked.

Each venue runs on its own subdomain. Venue apps are excluded from search engines.

Accounts and sign-in

Staff accounts can use two-factor authentication (TOTP). Platform administrators must set up two-factor authentication and recovery codes before they can use the admin console.

A trusted device lasts at most 30 days and is revoked when the password, two-factor setup, role, or account status changes. Only a hash of the device token is stored.

When an account has two-factor authentication, changing staff accounts or permissions requires a fresh two-factor check.

Sign-ins, failed sign-ins, trusted-device use, and staff and permission changes are written to an audit log.

Signup and abuse controls

Signup and the contact form are protected by Cloudflare Turnstile, checked on the server.

A new venue site goes live only after the owner confirms their email address.

Subdomains that imitate KalasOS, Trinity Technology, or platform services are refused.

Transport and browser protections

All traffic uses HTTPS, with HTTP Strict Transport Security on kalasos.com and its subdomains.

Pages are sent with headers that block framing by other sites, stop content-type sniffing, limit referrer data, and disable camera, microphone, and location access.

Payments and uploads

Card details are entered in Stripe's payment form and do not pass through KalasOS servers.

Uploaded images are checked by file content, not by name or declared type. SVG files are not accepted.

Reporting a vulnerability

Email security reports to contact@kalasos.com. Include the affected URL, steps to reproduce, and the impact you observed. Please do not access other customers' data, disrupt service, or run automated scans that degrade it.

A machine-readable contact is published at kalasos.com/.well-known/security.txt (RFC 9116).