How Kabora is run

Kabora has no SOC 2 report, no ISO 27001 certificate, and has not had a third-party penetration test. None of those have been started.

If your procurement process requires one of them, we do not meet it today, and we would rather you learn that here than three weeks into a conversation.

These are the companies that run parts of Kabora. Each one gets only what it needs to do its job.

• Vercel

  Runs the site, and stores uploaded photos.

• Neon

  Runs the database — every record described in the privacy policy.

• Resend

  Delivers our email, so it handles your address and the contents of what we send you.

• Stripe

  Processes card payments. Card numbers go to Stripe directly and Kabora never holds one.

  Only once card payments are switched on.

• Anthropic

  Answers Copilot and analyst questions.

  Only where an API key is configured. Without one the local driver says it cannot answer rather than guessing, and nothing leaves Kabora.

• Google, Facebook, Apple

  Sign you in.

  Only if you choose one. Not choosing them tells them nothing.

• Google Maps

  Draws the website's maps, and finds where an address or a town is. Kabora sends it the area on screen or the words being looked up, never your name or your account.

• Apple Maps

  Draws the maps in the iPhone app.

• OpenStreetMap

  Looks up what is nearby. Those lookups send a property's coordinates, never yours.

• Passkeys

  You can sign in with a passkey rather than a password. There is nothing to phish and nothing to reuse.

• Changing where money goes asks again

  Pointing payouts at a new account needs a fresh proof of identity, at the moment you do it. A passkey if you have one, an emailed code if you do not. One proof buys one change.

• Passwords are never stored

  Only a scrypt hash. We cannot read your password and neither can anyone who takes a copy of the database.

• Stored credentials are encrypted

  Credentials you give us for other services are sealed with AES-256-GCM before they are written down.

• Sign-in attempts are throttled and locked out

  Guessing at the door is rate-limited on every way in, not just the main one.

• A field-level audit log

  Changes to a record are written down with what changed, who changed it, and when.

• A Content-Security-Policy

  The browser is told which code it is allowed to run on our pages.

• One account cannot see another's data

  This is proven by a test that tries it and fails, on every run, rather than assumed from how the code is written.

• The books are checked nightly

  Data invariants — the money adding up, states being legal — are re-checked every night rather than at the moment somebody thinks to look.

Kabora keeps a register of every check it runs against itself — what each one verifies, whether a machine or a person performs it, and when it last passed. The number of checks that have never been run is on the same screen as the number that pass.

That register is internal today. We would rather tell you it exists and is unflattering than publish a summary of it that is not.

You cannot export your data yourself. Deleting an account works today; downloading everything first does not. Ask us and we will do it by hand.

There is no public status page. If Kabora is down, you find out by it being down.

We have never had a security incident to report — which is worth saying plainly is a statement about how young Kabora is, not about how strong it is.

If you think you have found a security problem, email security@kabora.app. Tell us what you found and how to see it. We will confirm we got it, and we will not threaten you for looking.

There is no bug bounty — no money, and we are not going to pretend otherwise.

Privacy says what we hold about you and why. Terms says who is responsible for what.