How Kabora is run

Kabora has no SOC 2 report, no ISO 27001 certificate, and has not had a third-party penetration test. None of those have been started.

If your procurement process requires one of them, Kabora does not meet it today. Kabora would rather you learn that here than three weeks into a conversation.

These are the companies that run parts of Kabora. Each one gets only what it needs to do its job.

• Vercel

  Runs the site, and stores uploaded photos.

• Neon

  Runs the database. Every record the privacy policy names is kept there.

• Resend

  Delivers Kabora's email, so it handles your address and the contents of what Kabora sends you.

• Stripe

  Processes card payments. Card numbers go to Stripe directly and Kabora never holds one.

• Anthropic

  Answers Assistant and analyst questions.

  Only where an API key is configured. Without one the local driver says it cannot answer rather than guessing, and nothing leaves Kabora.

• Google Firebase Crashlytics

  Receives a report when the Kabora app crashes: what failed, the phone's model and system and the app's version, with no name or account.

  Only while Kabora's crash-report switch is on, as it is by default.

• Google, Apple

  Sign you in.

  Only if you choose one. Not choosing them tells them nothing.

• Google Maps

  Draws the website's maps, and finds where an address or a town is. Kabora sends it the area on screen or the words being looked up, never your name or your account.

• Apple Maps

  Draws the maps in the iPhone app.

• OpenStreetMap

  Looks up what is nearby. Those lookups send a place's coordinates, never yours.

• Passkeys

  You can sign in with a passkey rather than a password. There is nothing to phish and nothing to reuse.

• Changing where money goes asks again

  Pointing payouts at a new account needs a fresh proof of identity, at the moment you do it. A passkey if you have one, a verification code if you do not. One proof buys one change.

• Passwords are never stored

  Only a scrypt hash. Kabora cannot read your password, and neither can anyone who takes a copy of the database.

• Stored credentials are encrypted

  Credentials you give Kabora for other services are sealed with AES-256-GCM before they are written down.

• Sign-in attempts are throttled and locked out

  Guessing at the door is rate-limited on every way in, not just the main one.

• A field-level audit log

  Changes to a record are written down with what changed, who changed it, and when.

• One account cannot see another's data

  This is proven by a test that tries it and fails, on every run, rather than assumed from how the code is written.

• Your browser blocks code Kabora did not put there

  Every page where you sign in, book, pay or run your business tells your browser which scripts may run: Kabora's own, and the payment, map and identity-check services. Each of Kabora's scripts carries a number made for that one page. Anything else, such as a script slipped into the page, is blocked, not just reported. This is a Content-Security-Policy.

• The books are checked nightly

  Every night, Kabora checks that the money adds up and that every booking is in a state that makes sense. It does not wait for somebody to think of looking.

Kabora keeps a register of every check it runs against itself: what each one verifies, whether a machine or a person performs it, and when it last passed. The number of checks that have never been run is on the same screen as the number that pass.

That register is internal today. Kabora would rather tell you that it exists and is unflattering than publish a summary of it that is not.

Kabora has never had a security incident to report. That is a statement about how young Kabora is, not about how strong it is.

If you think you have found a security problem, write to security@kabora.app. Describe what you found and how to see it. Kabora will confirm that it received your report, and will not threaten you for looking.

There is no bug bounty and no payment for reports, and Kabora will not pretend otherwise.

Privacy says what Kabora holds about you and why. Terms says who is responsible for what.