Loading...
Loading...
Security
Do Kaudi handles investor contacts, meeting notes, and price-sensitive information. Here is how we keep that data protected. We describe only what we actually do.
Each customer runs on an isolated, single-tenant deployment. There is no shared application database across companies. One company's data is never mixed with another's. If you are a partner managing several companies, each company's data is kept in its own isolated space.
Our infrastructure runs on Amazon Web Services (AWS) in an Indian region. Your data stays in-country and is not moved to overseas regions for storage.
All traffic to the application is served over HTTPS, and we enforce it with HTTP Strict Transport Security (HSTS) so browsers only ever connect over TLS. Data is encrypted at rest on our infrastructure. In short: your data is encrypted both in transit and at rest.
Access is role-based. Sensitive investor information and price-sensitive material is access-gated so that people only see what their role permits, rather than everyone in an account having unrestricted access to everything.
Passwords are hashed before storage (using passlib's sha256_crypt) and are never kept in plaintext. Login endpoints are rate-limited to slow down credential-guessing attacks, and the application uses CSRF protection to guard against cross-site request forgery.
If you believe you have found a security issue, we would like to hear from you. Please email [email protected] with the details so we can investigate and respond. We appreciate reports made in good faith and will work with you to confirm and address genuine issues.